ALAS2KERNEL-5.15-2023-019 --- kernelID: oval:org.secpod.oval:def:1701359 | Date: (C)2023-06-13 (M)2024-05-05 |
Class: PATCH | Family: unix |
A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation.The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups, but remove_on_exec made it possible to call list_del_event on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability.We recommend upgrading past commit fd0815f632c24878e325821943edccc7fde947a2
Product: |
kernel |
perf |
python-perf |
bpftool |