linux-cve-announce - CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025032714-CVE-2025-21889-0913@gregkh>
Date: Thu, 27 Mar 2025 15:58:23 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2025-21889: perf/core: Add RCU read lock protection to perf_iterate_ctx()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

perf/core: Add RCU read lock protection to perf_iterate_ctx()

The perf_iterate_ctx() function performs RCU list traversal but
currently lacks RCU read lock protection. This causes lockdep warnings
when running perf probe with unshare(1) under CONFIG_PROVE_RCU_LIST=y:

	WARNING: suspicious RCU usage
	kernel/events/core.c:8168 RCU-list traversed in non-reader section!!

	 Call Trace:
	  lockdep_rcu_suspicious
	  ? perf_event_addr_filters_apply
	  perf_iterate_ctx
	  perf_event_exec
	  begin_new_exec
	  ? load_elf_phdrs
	  load_elf_binary
	  ? lock_acquire
	  ? find_held_lock
	  ? bprm_execve
	  bprm_execve
	  do_execveat_common.isra.0
	  __x64_sys_execve
	  do_syscall_64
	  entry_SYSCALL_64_after_hwframe

This protection was previously present but was removed in commit
bd2756811766 ("perf: Rewrite core context handling"). Add back the
necessary rcu_read_lock()/rcu_read_unlock() pair around
perf_iterate_ctx() call in perf_event_exec().

[ mingo: Use scoped_guard() as suggested by Peter ]

The Linux kernel CVE team has assigned CVE-2025-21889 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.2 with commit bd27568117664b8b3e259721393df420ed51f57b and fixed in 6.6.81 with commit f390c2eea571945f357a2d3b9fcb1c015767132e
	Issue introduced in 6.2 with commit bd27568117664b8b3e259721393df420ed51f57b and fixed in 6.12.18 with commit a2475ccad6120546ea45dbcd6cd1f74dc565ef6b
	Issue introduced in 6.2 with commit bd27568117664b8b3e259721393df420ed51f57b and fixed in 6.13.6 with commit dd536566dda9a551fc2a2acfab5313a5bb13ed02
	Issue introduced in 6.2 with commit bd27568117664b8b3e259721393df420ed51f57b and fixed in 6.14 with commit 0fe8813baf4b2e865d3b2c735ce1a15b86002c74

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-21889
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/events/core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f390c2eea571945f357a2d3b9fcb1c015767132e
	https://git.kernel.org/stable/c/a2475ccad6120546ea45dbcd6cd1f74dc565ef6b
	https://git.kernel.org/stable/c/dd536566dda9a551fc2a2acfab5313a5bb13ed02
	https://git.kernel.org/stable/c/0fe8813baf4b2e865d3b2c735ce1a15b86002c74