Linux Kernel Out-of-Bounds Memory Corruption Vulnerability in Per-CPU CID Management

A vulnerability in the Linux kernel's handling of per-CPU CID (Context Identifier) management can lead to out-of-bounds memory corruption. This issue arises in the 'mm_cid_fixup_cpus_to_tasks()' function, where a newly forked or executed task may have its CID set to 'MM_CID_UNSET'. CIDs are assigned lazily, and if a task is active with an unset CID, the transition bit can be incorrectly manipulated. This flaw allows a bounded out-of-bounds write to occur, specifically clearing bit 31 of the CID bitmap, which is only num_possible_cpus() bits wide. The corruption affects kernel memory in an unpredictable manner, although it is not an arbitrary write. The vulnerability is triggered in per-CPU CID mode when a task's CID is still unset, creating a window of opportunity for memory corruption to occur.

Impact

Exploitation of this vulnerability causes memory corruption by clearing a bit in the CID bitmap that corresponds to a fixed offset of 256 MiB past the bitmap's base. This out-of-bounds write disrupts kernel memory management by overwriting a bit in an unintended location, potentially leading to further exploitation or instability within the kernel.

Reproduction

The vulnerability can be reproduced by creating a new task that is forked or executed while the system is in per-CPU CID mode. During this initial phase, the task's CID will be 'MM_CID_UNSET' because CIDs are not assigned until the task is scheduled in. Once the task is active with an unset CID, the 'mm_cid_fixup_cpus_to_tasks()' function can be invoked, which will incorrectly process the unset CID. This triggers the vulnerability by causing an out-of-bounds write to occur, specifically targeting the CID bitmap in the 'mm_struct' slab object.

Remediation

The vulnerability has been addressed by modifying the CID transition-bit assignment process to exclude 'MM_CID_UNSET', ensuring that the transition bit is only set for task-owned CIDs. Users should upgrade to the latest stable version of the Linux kernel where this vulnerability has been fixed.