Linux Kernel GCOV Concurrent Access Crash Vulnerability in IPComp Processing

A vulnerability in the Linux kernel's handling of GCOV instrumentation can lead to concurrent access crashes, particularly during IP Payload Compression (IPComp) processing. This issue arises because GCOV counters, which are global and not per-CPU, can be modified by one CPU while another CPU is reading the same counter. This interference causes inconsistent values and out-of-bounds memory writes. The problem manifests when the 'inflate_fast()' function is executed concurrently on multiple CPUs, leading to a page fault and a crash. The vulnerability has been addressed by modifying the kernel's build process to use atomic updates for GCOV counters, preventing the optimization that merges global counters with loop variables. This fix is applied selectively, depending on the architecture and the availability of atomic operations, ensuring compatibility without introducing unnecessary dependencies on external libraries.

Impact

Exploitation of this vulnerability can cause a crash due to a page fault, as the 'inflate_fast()' function attempts to write data 3.4 MB beyond the end of a 65 KB buffer. This out-of-bounds write can potentially be exploited to overwrite adjacent memory, leading to arbitrary code execution or other malicious outcomes.

Reproduction

The vulnerability can be reproduced by enabling GCOV coverage analysis in the Linux kernel and then running a workload that processes IPComp data. This should be done on a system with multiple CPUs, where the 'inflate_fast()' function can be executed concurrently on different processors. The resulting crash can be observed in the system logs, where a page fault error will indicate that the kernel was unable to handle a memory access violation, specifically referencing the 'inflate_fast()' function.

Remediation

The vulnerability has been fixed in the Linux kernel by updating the build process to use atomic operations for GCOV counters, which prevents the concurrent access issues that lead to crashes. Users should upgrade to the latest version of the Linux kernel where this fix has been applied.