Description
In the Linux kernel, the following vulnerability has been resolved: perf sched: Fix register_pid() overflow, strcpy, and BUG_ON register_pid() has several issues when processing untrusted perf.data: 1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap to a small value on 32-bit systems when pid is large (e.g. 0x40000000), causing realloc to return a tiny buffer followed by out-of-bounds writes in the initialization loop. 2. Heap buffer overflow: strcpy(task->comm, comm) copies the untrusted comm string into a fixed 20-byte COMM_LEN buffer with no length check. 3. BUG_ON on allocation failure: perf.data is untrusted input, so allocation failures should be handled gracefully rather than killing the process. 4. Realloc of sched->tasks assigned directly back, leaking the old pointer on failure; nr_tasks incremented before the realloc, leaving corrupted state on failure. Cap pid at PID_MAX_LIMIT (4194304, matching the kernel's maximum on 64-bit), replace strcpy with strlcpy, guard against NULL comm, replace BUG_ON with NULL returns using safe realloc patterns, and add NULL checks in callers that dereference the result.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ec156764d424dd67283c2cd5e9f6f1b8388364ac to < 344e59fc4f2cba6dc04ce5e2a77388645d4ca834affectedec156764d424dd67283c2cd5e9f6f1b8388364ac to < 22263d241bad753217d545f8085b7ead52e2873baffectedec156764d424dd67283c2cd5e9f6f1b8388364ac to < 2003918e13f43cf6c5698be3cc9aa3657dd676a8affectedec156764d424dd67283c2cd5e9f6f1b8388364ac to < 29639f00bfa49da7904ba0a499e0da7a0e5d735eaffectedec156764d424dd67283c2cd5e9f6f1b8388364ac to < 261d2b5f4afa0570ca906e553c93811c5abe4590affectedec156764d424dd67283c2cd5e9f6f1b8388364ac to < 652cea73b7b7b7c622a2be670e44e3c499c6d49faffectedec156764d424dd67283c2cd5e9f6f1b8388364ac to < 5ea1dcc9418c4e06ce29ed5170596f497ba86872affectedec156764d424dd67283c2cd5e9f6f1b8388364ac to < 5949d339f5ec98752d56dcd4e36f619a59d513a5affected
Linux Linux
Default version status: affected
2.6.32affected0 to < 2.6.32unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/344e59fc4f2cba6dc04ce5e2a77388645d4ca834 ↗
- https://git.kernel.org/stable/c/22263d241bad753217d545f8085b7ead52e2873b ↗
- https://git.kernel.org/stable/c/2003918e13f43cf6c5698be3cc9aa3657dd676a8 ↗
- https://git.kernel.org/stable/c/29639f00bfa49da7904ba0a499e0da7a0e5d735e ↗
- https://git.kernel.org/stable/c/261d2b5f4afa0570ca906e553c93811c5abe4590 ↗
- https://git.kernel.org/stable/c/652cea73b7b7b7c622a2be670e44e3c499c6d49f ↗
- https://git.kernel.org/stable/c/5ea1dcc9418c4e06ce29ed5170596f497ba86872 ↗
- https://git.kernel.org/stable/c/5949d339f5ec98752d56dcd4e36f619a59d513a5 ↗