In the Linux kernel, the following vulnerability has been resolved:
tracing: Fix trace_marker copy link list updates
When the "copy_trace_marker" option is enabled for an instance, anything
written into /sys/kernel/tracing/trace_marker is also copied into that
instances buffer. When the option is set, that instance's trace_array
descriptor is added to the marker_copies link list. This list is protected
by RCU, as all iterations uses an RCU protected list traversal.
When the instance is deleted, all the flags that were enabled are cleared.
This also clears the copy_trace_marker flag and removes the trace_array
descriptor from the list.
The issue is after the flags are called, a direct call to
update_marker_trace() is performed to clear the flag. This function
returns true if the state of the flag changed and false otherwise. If it
returns true here, synchronize_rcu() is called to make sure all readers
see that its removed from the list.
But since the flag was already cleared, the state does not change and the
synchronization is never called, leaving a possible UAF bug.
Move the clearing of all flags below the updating of the copy_trace_marker
option which then makes sure the synchronization is performed.
Also use the flag for checking the state in update_marker_trace() instead
of looking at if the list is empty.
A use-after-free (UAF) vulnerability exists in the Linux kernel's trace_marker functionality when the copy_trace_marker option is disabled. The vulnerability occurs due to improper RCU synchronization during instance deletion, where the synchronize_rcu() call is skipped when clearing the copy_trace_marker flag. This could allow local attackers to trigger memory corruption or denial of service on affected systems.
Immediate Actions:
1. Identify all Linux systems running affected kernel versions (7.0-rc1 through 7.0-rc4 and earlier versions with the vulnerability)
2. Disable trace_marker functionality if not actively used: echo 0 > /proc/sys/kernel/trace_marker_enabled
3. Restrict access to /sys/kernel/tracing/trace_marker to authorized users only: chmod 600 /sys/kernel/tracing/trace_marker
Patching Guidance:
1. Apply the latest stable kernel patch that includes the fix for trace_marker RCU synchronization
2. Test patches in non-production environments first, particularly for SCADA/industrial systems
3. Schedule maintenance windows for kernel updates on critical infrastructure
4. Verify patch application: grep -i 'trace_marker' /proc/version
Compensating Controls (if immediate patching not possible):
1. Implement kernel module loading restrictions: echo 1 > /proc/sys/kernel/modules_disabled
2. Enable SELinux/AppArmor with strict tracing policies
3. Monitor /sys/kernel/tracing/ directory for unauthorized access
4. Implement kernel audit rules: auditctl -w /sys/kernel/tracing/ -p wa -k trace_marker_access
Detection Rules:
1. Monitor for kernel oops/panic messages related to trace_marker
2. Alert on UAF detection: dmesg | grep -i 'use-after-free\|UAF\|trace_marker'
3. Track process access to /sys/kernel/tracing/trace_marker: auditctl -a always,exit -F dir=/sys/kernel/tracing/ -F perm=w -k trace_access
4. Monitor for unexpected kernel memory corruption patterns in system logs
الإجراءات الفورية:
1. تحديد جميع أنظمة لينكس التي تعمل بإصدارات النواة المتأثرة (7.0-rc1 إلى 7.0-rc4 والإصدارات السابقة)
2. تعطيل وظيفة trace_marker إذا لم تكن قيد الاستخدام النشط: echo 0 > /proc/sys/kernel/trace_marker_enabled
3. تقييد الوصول إلى /sys/kernel/tracing/trace_marker للمستخدمين المصرح لهم فقط: chmod 600 /sys/kernel/tracing/trace_marker
إرشادات التصحيح:
1. تطبيق أحدث تصحيح نواة مستقرة يتضمن إصلاح مزامنة RCU لـ trace_marker
2. اختبار التصحيحات في بيئات غير الإنتاج أولاً، خاصة لأنظمة SCADA
3. جدولة نوافذ الصيانة لتحديثات النواة على البنية التحتية الحرجة
4. التحقق من تطبيق التصحيح: grep -i 'trace_marker' /proc/version
الضوابط البديلة (إذا لم يكن التصحيح الفوري ممكناً):
1. تنفيذ قيود تحميل وحدات النواة: echo 1 > /proc/sys/kernel/modules_disabled
2. تفعيل SELinux/AppArmor مع سياسات تتبع صارمة
3. مراقبة دليل /sys/kernel/tracing/ للوصول غير المصرح به
4. تنفيذ قواعد تدقيق النواة: auditctl -w /sys/kernel/tracing/ -p wa -k trace_marker_access
قواعد الكشف:
1. مراقبة رسائل kernel oops/panic المتعلقة بـ trace_marker
2. التنبيه على كشف UAF: dmesg | grep -i 'use-after-free\|UAF\|trace_marker'
3. تتبع وصول العملية إلى /sys/kernel/tracing/trace_marker
4. مراقبة أنماط تلف ذاكرة النواة غير المتوقعة في سجلات النظام