[BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames

[shaos <shawnq1@163.com>]

Hello,

The x86 uprobe syscall checks only that regs->ip lies somewhere in the caller's executable [uprobes-trampoline] VMA, then trusts ax, r11, cx and retaddr copied from the user stack.  A process can jump into that VMA with a fabricated frame and make an enabled uprobe report a hit at a site it never executed, with caller-chosen register values.

HEAD commit:    fe2ec83746e501645709761605c2464a44fd2929
git tree:       upstream Linux checkout, local branch master
source version: Linux 7.3.0-rc4-70-gfe2ec83746e50
compiler:       gcc 11.4.0, GNU ld 2.38 (from the kernel build banner)

console output:
https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/9eb4cfbf7c87bf4b06cd6138775a13814ded54c6/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b1d9a09b984075b425aab4875117a6766a795110/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b7e400345a004b4a4c340eccad862ac1f569aaee/poc.c

Build the PoC and run it in a disposable VM with tracefs mounted.  First print the file offsets for site1 and site2, then register and enable a uprobe event at each offset.  The forge mode executes site1 once to map the trampoline, then makes the forged syscall from a uid 65534 child:

    cc -static -no-pie -O1 -fno-ipa-icf -fno-stack-protector -o forge poc.c
    mount -t tracefs tracefs /sys/kernel/tracing
    cp forge /forge
    /forge offsets
    echo "p:uprobes/site1 /forge:OFFSET1" > /sys/kernel/tracing/uprobe_events
    echo "p:uprobes/site2 /forge:OFFSET2" >> /sys/kernel/tracing/uprobe_events
    echo 1 > /sys/kernel/tracing/events/uprobes/site1/enable
    echo 1 > /sys/kernel/tracing/events/uprobes/site2/enable
    echo > /sys/kernel/tracing/trace
    /forge forge
    cat /sys/kernel/tracing/trace

Replace OFFSET1 and OFFSET2 with the file_off1 and file_off2 values printed by /forge offsets.  Run as root for tracefs setup; the PoC drops its forged child to uid 65534.  

Two fresh boots emitted a trace event for registered site2, which was never executed, and reported attacker-chosen ax/r11/cx values.  Legitimate execution produced only site1; an unregistered offset produced no site2 event; calling uprobe without the trampoline returned EPROTO.

Impact and prerequisites:
This falsifies tracing and profiling data for an enabled uprobe in the caller’s address space.  The evidence demonstrates event and register-value forgery, not kernel memory corruption, cross-process data disclosure, or privilege escalation.

A fix needs to authenticate the probe context before dispatching consumers.  Checking only the trampoline address is insufficient because that mapping is user-executable.

Validation: Two independent boots emitted a trace event for registered site2, which was never executed, with attacker-chosen register values.  Legitimate site1 execution, an unregistered offset, and a direct syscall without a mapped trampoline served as controls.

Thanks,

shaos