CVE-2024-57849
Published: 11 January 2025
Description
In the Linux kernel, the following vulnerability has been resolved: s390/cpum_sf: Handle CPU hotplug remove during sampling CPU hotplug remove handling triggers the following function call sequence: CPUHP_AP_PERF_S390_SF_ONLINE --> s390_pmu_sf_offline_cpu() ... CPUHP_AP_PERF_ONLINE --> perf_event_exit_cpu() The s390 CPUMF sampling CPU hotplug handler invokes: s390_pmu_sf_offline_cpu() +--> cpusf_pmu_setup() +--> setup_pmc_cpu() +--> deallocate_buffers() This function de-allocates all sampling data buffers (SDBs) allocated for that CPU at event initialization. It also clears the PMU_F_RESERVED bit. The CPU is gone and can not be sampled. With the event still being active on the removed CPU, the CPU event hotplug support in kernel performance subsystem triggers the following function calls on the removed CPU: perf_event_exit_cpu() +--> perf_event_exit_cpu_context() +--> __perf_event_exit_context() +--> __perf_remove_from_context() +--> event_sched_out() +--> cpumsf_pmu_del() +--> cpumsf_pmu_stop() +--> hw_perf_event_update() to stop and remove the event. During removal of the event, the sampling device driver tries to read out the remaining samples from the sample data buffers (SDBs). But they have already been freed (and may have been re-assigned). This may lead to a use after free situation in which case the samples are most likely invalid. In the best case the memory has not been reassigned and still contains valid data. Remedy this situation and check if the CPU is still in reserved state (bit PMU_F_RESERVED set). In this case the SDBs have not been released an contain valid data. This is always the case when the event is removed (and no CPU hotplug off occured). If the PMU_F_RESERVED bit is not set, the SDB buffers are gone.
Security Summary
CVE-2024-57849 is a use-after-free vulnerability (CWE-416) in the Linux kernel's s390/cpum_sf component, which handles CPU Measurement Facility (CPUMF) sampling on s390 architecture systems. The issue arises during CPU hotplug removal while sampling is active. When a CPU is offlined, the s390_pmu_sf_offline_cpu function deallocates sampling data buffers (SDBs) and clears the PMU_F_RESERVED bit. However, the kernel's performance subsystem subsequently invokes perf_event_exit_cpu on the removed CPU, leading to attempts to read from the already-freed SDBs via functions like cpumsf_pmu_stop and hw_perf_event_update. This affects Linux kernels supporting s390 platforms, such as those on IBM Z mainframes.
A local attacker with low privileges (PR:L) can exploit this vulnerability with low attack complexity (AC:L) and no user interaction (UI:N) in an unprivileged context (S:U). By triggering CPU hotplug removal during an active sampling event, the attacker can cause the kernel to access freed memory, potentially leading to high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), as indicated by the CVSS v3.1 score of 7.8. In the worst case, this results in invalid sample data or kernel crashes due to the use-after-free condition.
Mitigation involves applying upstream kernel patches referenced in the stable commit logs, such as those at https://git.kernel.org/stable/c/06a92f810df8037ca36157282ddcbefdcaf049b8 and related commits. These patches remedy the issue by checking the PMU_F_RESERVED bit before accessing SDBs during event removal; if the bit is not set, the buffers are recognized as deallocated, preventing the use-after-free. Security practitioners should update to kernels incorporating these fixes and monitor for CPU hotplug events in s390 environments using performance monitoring tools.
Details
- CWE(s)