{"vulnerability": "ghsa-v75f-hc9p-6g26", "sightings": [{"uuid": "1c851a5e-23e6-4e4b-9b15-5ed5edf3ef9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-V75F-HC9P-6G26", "type": "published-proof-of-concept", "source": "https://t.me/HackerArsenal/71", "content": "https://github.com/advisories/GHSA-v75f-hc9p-6g26\n\nstress-ng --cyclic 30 --timeout 30 --minimize --quiet\nkmemleak frequently reported a memory leak concerning the task_struct:\nunreferenced object 0xffff8881305b8000 (size 16136):\ncomm \"stress-ng\", pid 614, jiffies 4294883961 (age 286.412s)\nobject hex dump (first 32 bytes):\n02 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .@..............\n00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\ndebug hex dump (first 16 bytes):\n53 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 S...............\nbacktrace:\n[<00000000046b6790>] dup_task_struct+0x30/0x540\n[<00000000c5ca0f0b>] copy_process+0x3d9/0x50e0\n[<00000000ced59777>] kernel_clone+0xb0/0x770\n[<00000000a50befdc>] __do_sys_clone+0xb6/0xf0\n[<000000001dbf2008>] do_syscall_64+0x5d/0xf0\n[<00000000552900ff>] entry_SYSCALL_64_after_hwframe+0x6e/0x76\nThe issue occurs in start_dl_timer(), which increments the task_struct\nreference count and sets a timer. The timer callback, dl_task_timer,\nis supposed to decrement the reference count upon expiration. However,\nif enqueue_task_dl() is called before the timer expires and cancels it,\nthe reference count is not decremented, leading to the leak.\n\n#kernal #leak #vulnerability #linux", "creation_timestamp": "2024-07-30T04:27:38.000000Z"}]}