In the Linux kernel, the following vulnerability has been resolved:
exit: hold a reference to thread_pid across proc_flush_pid
Commit 0a36bad01731 ("release_task: kill the no longer needed
get/put_pid(thread_pid)") removed the reference around proc_flush_pid().
It assumed that free_pids(post.pids) at the end of release_task() would
keep thread_pid alive until then.
That assumption is wrong. __change_pid() only records a detached PID in
post.pids when pid_has_task() is false for every PIDTYPE. If another task
still uses the exiting task's PID as its process group or session ID,
__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves
the PID out of post.pids. release_task() therefore holds no reference to
it after dropping tasklist_lock.
The other task can then remove the remaining PIDTYPE links. Its
free_pids() call schedules delayed_put_pid(), and the RCU callback can free
the PID before the first release_task() reaches proc_flush_pid().
An unprivileged reproducer races wait4(-1) against setsid() to trigger this
ordering. Three of three fresh v7.2 KASAN boots reported:
<pre>
BUG: KASAN: slab-use-after-free in
proc_invalidate_siblings_dcache+0x3e2/0x3f0
Read of size 8 by task h7_pid_reaper/1921
Call Trace:
proc_invalidate_siblings_dcache
release_task
wait_consider_task
__do_wait
do_wait
kernel_wait4
Freed by task 0:
kmem_cache_free
put_pid
delayed_put_pid
rcu_core
Last potentially related work creation:
__call_rcu_common
free_pids
ksys_setsid
</pre>
KASAN identified a 144-byte object from the pid cache and located the bad
read 80 bytes into the freed object, matching pid->inodes. With an
explicit reference, three of three fresh boots completed without a KASAN
report. The concurrent RCU callback dropped its reference while
proc_flush_pid() was protected, and the balancing put_pid() performed the
final free afterward.
Take a reference before __unhash_process() clears p->thread_pid and release
it after proc_flush_pid() completes.
A tested source reproducer is available privately on request. No
controlled read or write, information leak, or privilege escalation is
claimed. The mainline patch applies directly to v6.19.y and newer;
v6.16.y through v6.18.y need a context-adjusted backport.
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.8
AV:L - The freed struct pid is reached through release_task() -> proc_flush_pid() when a local process reaps a child via wait4()/waitid(), racing with ksys_setsid() in another local process; no network or remote data is involved.
AC:L - The attacker controls both sides of the race: its own parent calls wait4(-1) on an exiting process-group leader while its own child, still in that pgrp, calls setsid() to drop the last PID link. The loop can be retried without limit, and syzbot plus the author's reproducer hit it reliably.
PR:L - Needs only an ordinary local account able to fork, setpgid/setsid and wait4 its own children. There is no capability check anywhere on the release_task()/ksys_setsid() path.
UI:N - The attacker triggers the whole sequence with its own processes. No other user or administrator action is needed.
S:U - This is memory corruption inside the kernel's own pid/procfs bookkeeping, which stays within the kernel security authority; no VM or hardware isolation boundary is crossed.
C:H - proc_invalidate_siblings_dcache() reads pid->inodes from the freed struct pid and follows it as a proc_inode pointer (igrab, d_find_alias). With the slot reclaimed by attacker-shaped data, that use-after-free lets the attacker dereference pointers it controls, which supports kernel memory disclosure.
I:H - On the freed object the function takes spin_lock(&pid->lock) and runs hlist_del_init_rcu() on node pointers taken from it, which are unlink-style writes. It then calls igrab/iput/d_invalidate on an inode it derived from freed memory, a use-after-free write primitive usable for memory corruption.
A:H - KASAN reports a slab-use-after-free in proc_invalidate_siblings_dcache from release_task. Without KASAN, the list walk or igrab on a reallocated pid slot can oops or corrupt the dcache and crash the kernel.
| Attack Vector |
Local |
Scope |
Unchanged |
| Attack Complexity |
Low |
Confidentiality Impact |
High |
| Privileges Required |
Low |
Integrity Impact |
High |
| User Interaction |
None |
Availability Impact |
High |
AV:L - The freed struct pid is reached through release_task() -> proc_flush_pid() when a local process reaps a child via wait4()/waitid(), racing with ksys_setsid() in another local process; no network or remote data is involved.
AC:L - The attacker controls both sides of the race: its own parent calls wait4(-1) on an exiting process-group leader while its own child, still in that pgrp, calls setsid() to drop the last PID link. The loop can be retried without limit, and syzbot plus the author's reproducer hit it reliably.
PR:L - Needs only an ordinary local account able to fork, setpgid/setsid and wait4 its own children. There is no capability check anywhere on the release_task()/ksys_setsid() path.
UI:N - The attacker triggers the whole sequence with its own processes. No other user or administrator action is needed.
S:U - This is memory corruption inside the kernel's own pid/procfs bookkeeping, which stays within the kernel security authority; no VM or hardware isolation boundary is crossed.
C:H - proc_invalidate_siblings_dcache() reads pid->inodes from the freed struct pid and follows it as a proc_inode pointer (igrab, d_find_alias). With the slot reclaimed by attacker-shaped data, that use-after-free lets the attacker dereference pointers it controls, which supports kernel memory disclosure.
I:H - On the freed object the function takes spin_lock(&pid->lock) and runs hlist_del_init_rcu() on node pointers taken from it, which are unlink-style writes. It then calls igrab/iput/d_invalidate on an inode it derived from freed memory, a use-after-free write primitive usable for memory corruption.
A:H - KASAN reports a slab-use-after-free in proc_invalidate_siblings_dcache from release_task. Without KASAN, the list walk or igrab on a reallocated pid slot can oops or corrupt the dcache and crash the kernel.
CVSS 3.1