Към съдържанието
Търсене

CVE-2026-64560: Linux, състезание за ресурс

7.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се локално, без особени условия, с обикновен потребителски вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката не може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent UAF caused by non-leader exec() race Wongi and Jungwoo decoded and reported a non-leader exec() related race which can result in an UAF: sys_timer_delete() exec() posix_cpu_timer_del() // Observes old leader p = pid_task(pid, pid_type); de_thread() switch_leader(); release_task(old_leader) __exit_signal(old_leader) sighand = lock(old_leader, sighand); posix_cpu_timers*_exit(); sighand = lock_task_sighand(p) unhash_task(old_leader); sh = lock(p, sighand) old_leader->sighand = NULL; unlock(sighand); (p->sighand == NULL) unlock(sh) return NULL; // Returns without action if(!sighand) return 0; free_posix_timer(); This is "harmless" unless the deleted timer was armed and enqueued in p->signal because on exec() a TGID targeted timer is inherited. As sys_timer_delete() freed the underlying posix timer object run_posix_cpu_timers() or any timerqueue related add/delete operations on other timers will access the freed object's timerqueue node, which results in an UAF. There is a similar problem vs. posix_cpu_timer_set(). For regular posix timers it just transiently returns -ESRCH to user space, but for the use case in do_cpu_nanosleep() it's the same UAF just that the k_itimer is allocated on the stack. Also posix_cpu_timer_rearm() fails to rearm the timer, which means it stops to expire. While debating solutions Frederic pointed out another problem: posix_cpu_timer_del(tmr) __exit_signal(p) posix_cpu_timers*_exit(p); unhash_task(p); p->sighand = NULL; sh = lock_task_sighand(p) sighand = p->sighand; if (!sighand) return NULL; lock(sighand); if (!sh) WARN_ON_ONCE(timer_queued(tmr)); On weakly ordered architectures it is not guaranteed that posix_cpu_timer_del() will observe the stores in posix_cpu_time

Засегнати продукти

  • Linux Linux: 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 преди 67aa823e3e8c229c6d374df79c804f6721cb83b6; 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 преди d8bcb28abad857f1415da7656f19b2ada90af04f; 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 преди cc35ddbc497311e0b6b9a6a6a4f4d1217d6ab1aa; 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 преди 12a891c773aeb5823d63dbd0cb2ab931d6c21c9b; 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 преди e74443f5db0037c556ef436fa64b88bf4ea08f83; 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 преди 6a7ecc25abe6f0fecc6e62a05096987200edbd02; 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 преди ad1cafa1bdaa71da85d71cac053838bbe97852b6; 55e8c8eb2c7b6bf30e99423ccfe7ca032f498f59 преди 920f893f735e92ba3a1cd9256899a186b161928d
  • Linux Linux: 5.7; преди 5.7; 5.10.262 до 5.10.*; 5.15.213 до 5.15.*; 6.1.180 до 6.1.*; 6.6.147 до 6.6.*; 6.12.100 до 6.12.*; 6.18.41 до 6.18.*; 7.1.5 до 7.1.*; от 7.2 нататък
  • Siemens: още 4 продукта, добавени от Siemens

    SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, SIMATIC S7-1500 TM MFP - GNU/Linux subsystem, SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Вид слабост

История

  • 29 юли 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-64560: Linux, състезание за ресурс | freedomonline.bg