| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025081907-CVE-2025-38563-81e4@gregkh> Date: Tue, 19 Aug 2025 19:18:10 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2025-38563: perf/core: Prevent VMA split of buffer mappings From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: perf/core: Prevent VMA split of buffer mappings The perf mmap code is careful about mmap()'ing the user page with the ringbuffer and additionally the auxiliary buffer, when the event supports it. Once the first mapping is established, subsequent mapping have to use the same offset and the same size in both cases. The reference counting for the ringbuffer and the auxiliary buffer depends on this being correct. Though perf does not prevent that a related mapping is split via mmap(2), munmap(2) or mremap(2). A split of a VMA results in perf_mmap_open() calls, which take reference counts, but then the subsequent perf_mmap_close() calls are not longer fulfilling the offset and size checks. This leads to reference count leaks. As perf already has the requirement for subsequent mappings to match the initial mapping, the obvious consequence is that VMA splits, caused by resizing of a mapping or partial unmapping, have to be prevented. Implement the vm_operations_struct::may_split() callback and return unconditionally -EINVAL. That ensures that the mapping offsets and sizes cannot be changed after the fact. Remapping to a different fixed address with the same size is still possible as it takes the references for the new mapping and drops those of the old mapping. The Linux kernel CVE team has assigned CVE-2025-38563 to this issue. Affected and fixed versions =========================== Issue introduced in 4.1 with commit 45bfb2e50471abbbfd83d40d28c986078b0d24ff and fixed in 6.1.148 with commit 7b84cb58d1f0aa07656802eae24689566e5f5b1b Issue introduced in 4.1 with commit 45bfb2e50471abbbfd83d40d28c986078b0d24ff and fixed in 6.6.102 with commit 6757a31a8e295ae4f01717a954afda173f25a121 Issue introduced in 4.1 with commit 45bfb2e50471abbbfd83d40d28c986078b0d24ff and fixed in 6.12.42 with commit e529888b7e8092912dd8789bdfc76685ccd2ff5f Issue introduced in 4.1 with commit 45bfb2e50471abbbfd83d40d28c986078b0d24ff and fixed in 6.15.10 with commit ff668930871e0198c7f4e325058b8b7c286787bd Issue introduced in 4.1 with commit 45bfb2e50471abbbfd83d40d28c986078b0d24ff and fixed in 6.16.1 with commit 65311aad4c808bedad0c05d9bb8b06c47dae73eb Issue introduced in 4.1 with commit 45bfb2e50471abbbfd83d40d28c986078b0d24ff and fixed in 6.17-rc1 with commit b024d7b56c77191cde544f838debb7f8451cd0d6 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2025-38563 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: kernel/events/core.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/7b84cb58d1f0aa07656802eae24689566e5f5b1b https://git.kernel.org/stable/c/6757a31a8e295ae4f01717a954afda173f25a121 https://git.kernel.org/stable/c/e529888b7e8092912dd8789bdfc76685ccd2ff5f https://git.kernel.org/stable/c/ff668930871e0198c7f4e325058b8b7c286787bd https://git.kernel.org/stable/c/65311aad4c808bedad0c05d9bb8b06c47dae73eb https://git.kernel.org/stable/c/b024d7b56c77191cde544f838debb7f8451cd0d6
Powered by blists - more mailing lists