Executive Summary

This vulnerability exists in the Linux kernel's tracing subsystem. When a process forks, the child process copies the parent's virtual memory areas (VMAs), but the user_mapped reference count is not incremented accordingly. As a result, when both the parent and child processes exit, the function tracing_buffers_mmap_close() is called twice. On the second call, the user_mapped count is already zero, causing the function to return an error (-ENODEV) and triggering a WARN_ON warning.

Normally, this issue does not occur because the memory is mapped with the VM_DONTCOPY flag, which prevents copying on fork. However, if an application calls madvise(MADV_DOFORK), it resets the VM_DONTCOPY flag, allowing this vulnerability to be triggered during a fork.

The fix involves incrementing the user_mapped reference count properly without re-mapping the pages in the VMA's open callback to prevent the double call issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the Linux kernel to trigger a WARN_ON warning and return an error during process exit when certain memory mappings are involved. This may lead to instability or unexpected behavior in applications that use the tracing subsystem and call madvise(MADV_DOFORK).

While it does not directly indicate a security breach like data leakage or privilege escalation, it can cause system warnings and potential disruptions in process management, which might affect system reliability.

Useful 0 Not Useful 0