perf tools: out-of-bounds heap read parsing a crafted perf.data CPU index

Impact

machine__resolve() indexes env->cpu with a CPU number taken straight from a perf.data sample, checking only that it is non-negative and that the array exists, never that it is below env->nr_cpus_avail. A crafted perf.data therefore produces an out-of-bounds heap read, and values such as 65536 truncate to 0 on the cast to int16_t and silently return CPU 0's topology instead. This matters on a GPU fleet only in one flow: an operator or support engineer running perf report or perf script over a profile handed to them by a tenant or pulled from a shared scratch filesystem. It is a read in an unprivileged userspace tool, not a kernel-side flaw - the realistic outcome is a crash or leaked heap bytes in the analysis process, and mis-attributed topology in the resulting profile.

Who can reach it

Anyone who can hand an operator a perf.data file, or write one where an operator will later analyse it. Requires the victim to run the perf tooling on that file; no privilege is gained on the profiled machine itself.

What to do

Update the perf userspace package (linux-tools / perf-tools, per distribution) to a build carrying the fix that routes the lookup through perf_env__get_cpu_topology() and bounds-checks al->cpu before the int16_t cast; the stable commits are 5484b43a0ec8, b9e8406651dc and eb266a14c16a. This is a userspace tool, so no reboot or node drain is needed - the running kernel is unaffected. Until then, do not run perf report or perf script on perf.data files from untrusted tenants. No fixed version number is stated in the record.

References

Related entries

• QEMU VGA device model (hw/display/vga.c) - banked access to video memory: 'Dark Portal' - the guest sets the VGA bankCVE-2016-3710 · QEMU VGA device model (hw/display/vga.c) - banked access to video memoryHigh
• Xen x86 PV pagetable update fast paths (arch/x86/mm.c): A 32-bit PV guest administrator gains full host privileges byCVE-2016-6258 · Xen x86 PV pagetable update fast paths (arch/x86/mm.c)High
• VMware ESXi (OpenSLP): OpenSLP heap overflow - the ESXiArgs ransomware entry point that mass-encrypted thousandsCVE-2021-21974 · VMware ESXi (OpenSLP)High
• Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect(): A guest write to the virtual IOAPIC causes a stackCVE-2021-47390 · Linux KVM x86 - stack out-of-bounds in ioapic_write_indirect()High
• Xen (xenstored): Guest can crash xenstored, taking down control-plane services for all guests on the hostCVE-2022-42309 · Xen (xenstored)High
• Linux kernel drivers/vdpa/mlx5 (mlx5 vDPA net device): A guest with an assigned mlx5 vDPA net device sends anCVE-2022-48864 · Linux kernel drivers/vdpa/mlx5 (mlx5 vDPA net device)High