Listen to this Post
In the Linux kernel’s perf subsystem, a vulnerability arises from improper handling of event groups during throttling. When a group leader event is configured with an aggressive sampling period (e.g., sample_period=1), it triggers frequent interrupts and activates throttling mechanisms. A sibling event within the same group, created in a disabled state (.disabled=1), remains in PERF_EVENT_STATE_OFF. Its hardware index (event->hw.idx) stays at -1 as it is never scheduled on the PMU. During throttling, functions like perf_event_throttle_group() iterate over all group members, including this inactive event. Consequently, perf_event_throttle() or perf_event_unthrottle() is called on it, leading to a call to the PMU driver’s start() or stop() method. The driver receives the event with hw.idx = -1. When this negative value is used as a shift exponent in bitwise operations—for instance, within macros like PMCNTENSET(idx)—it causes undefined behavior, triggering UBSAN shift-out-of-bounds reports. The logical flaw is corrected by moving state checks into the throttle/unthrottle functions, ensuring only active events with valid indices are processed.
Platform: Linux kernel
Version: Multiple versions
Vulnerability: Perf throttling flaw
Severity: Medium
date: 2025-09-16
Prediction: Patched 2025-09-16
What Undercode Say:
Analytics:
Syzkaller reproducer reference
syz-manager -config=perf.cfg
Kernel patch example
diff –git a/kernel/events/core.c b/kernel/events/core.c
a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -X, Y +X, Y @@
-if (event->state == PERF_EVENT_STATE_OFF)
+if (event->state != PERF_EVENT_STATE_ACTIVE)
How Exploit:
Trigger throttling on disabled perf events.
Protection from this CVE:
Update Linux kernel.
Impact:
Undefined behavior, crashes.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
