Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

uprobes/x86: Move optimized uprobe from nop5 to nop10

Andrii reported an issue with optimized uprobes [1] that can clobber redzone area with call instruction storing return address on stack where user code may keep temporary data without adjusting rsp.

Fixing this by moving the optimized uprobes on top of 10-bytes nop instruction, so we can squeeze another instruction to escape the redzone area before doing the call, like:

lea -0x80(%rsp), %rsp call tramp

Note the lea instruction is used to adjust the rsp register without changing the flags.

We use nop10 and following transformation to optimized instructions above and back as suggested by Peterz [2].

Optimize path (int3_update_optimize):

1) Initial state after set_swbp() installed the uprobe: cc 2e 0f 1f 84 00 00 00 00 00

From offset 0 this is INT3 followed by the tail of the original 10-byte NOP.

After a previous unoptimization bytes 5..9 may still contain the old call instruction, which remains valid for threads already there.

2) Rewrite the LEA tail and call displacement: cc [8d 64 24 80 e8 d0 d1 d2 d3]

From offset 0 this traps on the uprobe INT3. Bytes 1..9 are not executable entry points while byte 0 is trapped.

3) Publish the first LEA byte: [48] 8d 64 24 80 e8 d0 d1 d2 d3

From offset 0 this is: lea -0x80(%rsp), %rsp call <uprobe-trampoline>

Unoptimize path (…