linux-kernel - Re: [External] : Re: CVE-2024-26920: tracing/trigger: Fix to return error if failed to alloc snapshot

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <92ec3ce16c7e640de19b44165e2bb88b63dd2478.camel@oracle.com>
Date: Thu, 18 Apr 2024 13:06:42 +0000
From: Siddh Raman Pant <siddh.raman.pant@...cle.com>
To: "gregkh@...uxfoundation.org" <gregkh@...uxfoundation.org>
CC: "cve@...nel.org" <cve@...nel.org>,
        "linux-cve-announce@...r.kernel.org"
	<linux-cve-announce@...r.kernel.org>,
        "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>
Subject: Re: [External] : Re: CVE-2024-26920: tracing/trigger: Fix to return
 error if failed to alloc snapshot

On Thu, Apr 18 2024 at 14:34:57 +0200, gregkh@...uxfoundation.org
wrote:
> On Thu, Apr 18, 2024 at 11:59:41AM +0000, Siddh Raman Pant wrote:
> > Hi Greg,
> > 
> > > In the Linux kernel, the following vulnerability has been resolved:
> > > 
> > > tracing/trigger: Fix to return error if failed to alloc snapshot
> > > 
> > > Fix register_snapshot_trigger() to return error code if it failed to
> > > allocate a snapshot instead of 0 (success). Unless that, it will register
> > > snapshot trigger without an error.
> > 
> > This commit is problematic on 4.19.y, 5.4.y, 5.10.y, and 5.15.y,
> > and should be reversed, and this CVE should be rejected for those
> > versions.
> 
> Then please submit a patch for this.

Sure.


> But note, CVEs are not for specific versions, sorry.  We give a hint as
> to what kernel versions might be affected, but we don not assign CVE to
> versions.

Cool.

> > 
> > The return value should be 0 on failure, because in the functions
> > event_trigger_callback() and event_enable_trigger_func(), we have:
> > 
> > 	ret = cmd_ops->reg(glob, trigger_ops, trigger_data, file);
> > 	/*
> > 	 * The above returns on success the # of functions enabled,
> > 	 * but if it didn't find any functions it returns zero.
> > 	 * Consider no functions a failure too.
> > 	 */
> > 	if (!ret) {
> > 		ret = -ENOENT;
> > 
> > Thus, the commit breaks this assumption.
> > 
> > This commit needs b8cc44a4d3c1 ("tracing: Remove logic for registering
> > multiple event triggers at a time") as a prerequisite, as it removes
> > the above.
> 
> Should we just take that patch instead?

The series in which the patch is posted is here:
- https://lore.kernel.org/lkml/cover.1644010575.git.zanussi@kernel.org/
- https://lore.kernel.org/lkml/cover.1641823001.git.zanussi@kernel.org/

Seems like some good tracing subsystem refactoring. So if I understand
Documentation/process/stable-kernel-rules.rst correctly, I would say we
should not.

Thanks,
Siddh

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)