HIGH
perf Event Group Heap Overflow
CVE-2023-6931
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_group(). We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.
02KernelScan AI Analysis
Risk summary
An attacker with local access and perf event creation privileges can trigger a heap buffer overflow by carefully crafting performance monitoring event groups. This can lead to kernel memory corruption and potential privilege escalation to root. The attack requires specific knowledge of perf event internals but is reliable once the conditions are met.
Vulnerability analysis
Root Cause: The perf_event_validate_size() function only validated the size of newly added events without checking that existing events in the group would also have their read_size recalculated when the new event is attached. Since events can have different read_format attributes, adding a new event could cause existing events' read_size to overflow the 16KB limit, leading to heap out-of-bounds writes in perf_read_group().
Attack Surface: Local attack surface requiring the ability to create perf events. Attackers need sufficient privileges to use the perf_event_open() system call, which typically requires CAP_SYS_ADMIN or relaxed perf_event_paranoid settings. The vulnerability is triggered when adding events to performance monitoring groups with specific read_format configurations.
Fix Mechanism: The patch refactors perf_event_validate_size() to check all events in the group (the new event, group leader, and all siblings) to ensure their read_size would not exceed 16KB after the new event is added. It also extracts the size calculation logic into a separate __perf_event_read_size() function that takes read_format and nr_siblings as parameters, making validation more comprehensive.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| mainline | 6.7 | 382c27f4ed28 |