Executive Summary

This vulnerability occurs in the Linux kernel when a task that is already exiting experiences an oops (a kernel error). During this process, the function make_task_dead() calls do_task_dead() with preemption enabled, which is not allowed because do_task_dead() calls __schedule(), a function that must be called with preemption disabled.

If the oopsing task is preempted while in do_task_dead(), between becoming TASK_DEAD and entering the scheduler, the scheduler's assumptions break down. Specifically, finish_task_switch() assumes that once a TASK_DEAD task is switched away from, it will never run again and its stack is no longer needed. However, if the dead task was preempted, this assumption fails.

As a result, the scheduler may repeatedly drop references on the dead task's stack, leading to use-after-free or double-free conditions of the task's stack memory. This can cause two tasks to run on the same stack, resulting in various kinds of memory corruption.

This issue can occur even if the task only oops once during exit, such as in a file_operations::release handler, and is not limited to recursively oopsing tasks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to memory corruption in the Linux kernel due to use-after-free or double-free of task stacks. Such memory corruption can cause system instability, crashes, or unpredictable behavior.

Because two tasks might end up running on the same stack, this can potentially be exploited to execute arbitrary code or cause denial of service, depending on the context and attacker capabilities.

Useful 0 Not Useful 0