CVE-2024-57849

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> s390/cpum_sf: Handle CPU hotplug remove during sampling<br /> <br /> CPU hotplug remove handling triggers the following function<br /> call sequence:<br /> <br /> CPUHP_AP_PERF_S390_SF_ONLINE --&gt; s390_pmu_sf_offline_cpu()<br /> ...<br /> CPUHP_AP_PERF_ONLINE --&gt; perf_event_exit_cpu()<br /> <br /> The s390 CPUMF sampling CPU hotplug handler invokes:<br /> <br /> s390_pmu_sf_offline_cpu()<br /> +--&gt; cpusf_pmu_setup()<br /> +--&gt; setup_pmc_cpu()<br /> +--&gt; deallocate_buffers()<br /> <br /> This function de-allocates all sampling data buffers (SDBs) allocated<br /> for that CPU at event initialization. It also clears the<br /> PMU_F_RESERVED bit. The CPU is gone and can not be sampled.<br /> <br /> With the event still being active on the removed CPU, the CPU event<br /> hotplug support in kernel performance subsystem triggers the<br /> following function calls on the removed CPU:<br /> <br /> perf_event_exit_cpu()<br /> +--&gt; perf_event_exit_cpu_context()<br /> +--&gt; __perf_event_exit_context()<br /> +--&gt; __perf_remove_from_context()<br /> +--&gt; event_sched_out()<br /> +--&gt; cpumsf_pmu_del()<br /> +--&gt; cpumsf_pmu_stop()<br /> +--&gt; hw_perf_event_update()<br /> <br /> to stop and remove the event. During removal of the event, the<br /> sampling device driver tries to read out the remaining samples from<br /> the sample data buffers (SDBs). But they have already been freed<br /> (and may have been re-assigned). This may lead to a use after free<br /> situation in which case the samples are most likely invalid. In the<br /> best case the memory has not been reassigned and still contains<br /> valid data.<br /> <br /> Remedy this situation and check if the CPU is still in reserved<br /> state (bit PMU_F_RESERVED set). In this case the SDBs have not been<br /> released an contain valid data. This is always the case when<br /> the event is removed (and no CPU hotplug off occured).<br /> If the PMU_F_RESERVED bit is not set, the SDB buffers are gone.