[BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames

[BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames

[shaos]

Hello,

The x86 uprobe syscall checks only that regs->ip lies somewhere in the caller's executable [uprobes-trampoline] VMA, then trusts ax, r11, cx and retaddr copied from the user stack.  A process can jump into that VMA with a fabricated frame and make an enabled uprobe report a hit at a site it never executed, with caller-chosen register values.

HEAD commit:    fe2ec83746e501645709761605c2464a44fd2929
git tree:       upstream Linux checkout, local branch master
source version: Linux 7.3.0-rc4-70-gfe2ec83746e50
compiler:       gcc 11.4.0, GNU ld 2.38 (from the kernel build banner)

console output:
https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/9eb4cfbf7c87bf4b06cd6138775a13814ded54c6/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b1d9a09b984075b425aab4875117a6766a795110/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b7e400345a004b4a4c340eccad862ac1f569aaee/poc.c

Build the PoC and run it in a disposable VM with tracefs mounted.  First print the file offsets for site1 and site2, then register and enable a uprobe event at each offset.  The forge mode executes site1 once to map the trampoline, then makes the forged syscall from a uid 65534 child:

    cc -static -no-pie -O1 -fno-ipa-icf -fno-stack-protector -o forge poc.c
    mount -t tracefs tracefs /sys/kernel/tracing
    cp forge /forge
    /forge offsets
    echo "p:uprobes/site1 /forge:OFFSET1" > /sys/kernel/tracing/uprobe_events
    echo "p:uprobes/site2 /forge:OFFSET2" >> /sys/kernel/tracing/uprobe_events
    echo 1 > /sys/kernel/tracing/events/uprobes/site1/enable
    echo 1 > /sys/kernel/tracing/events/uprobes/site2/enable
    echo > /sys/kernel/tracing/trace
    /forge forge
    cat /sys/kernel/tracing/trace

Replace OFFSET1 and OFFSET2 with the file_off1 and file_off2 values printed by /forge offsets.  Run as root for tracefs setup; the PoC drops its forged child to uid 65534.  

Two fresh boots emitted a trace event for registered site2, which was never executed, and reported attacker-chosen ax/r11/cx values.  Legitimate execution produced only site1; an unregistered offset produced no site2 event; calling uprobe without the trampoline returned EPROTO.

Impact and prerequisites:
This falsifies tracing and profiling data for an enabled uprobe in the caller’s address space.  The evidence demonstrates event and register-value forgery, not kernel memory corruption, cross-process data disclosure, or privilege escalation.

A fix needs to authenticate the probe context before dispatching consumers.  Checking only the trampoline address is insufficient because that mapping is user-executable.

Validation: Two independent boots emitted a trace event for registered site2, which was never executed, with attacker-chosen register values.  Legitimate site1 execution, an unregistered offset, and a direct syscall without a mapped trampoline served as controls.

Thanks,

shaos

Re: [BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames

[Oleg Nesterov]

On 10/20, shaos wrote:
>
> The x86 uprobe syscall checks only that regs->ip lies somewhere in the caller's
> executable [uprobes-trampoline] VMA, then trusts ax, r11, cx and retaddr copied
> from the user stack.  A process can jump into that VMA with a fabricated frame
> and make an enabled uprobe report a hit at a site it never executed, with
> caller-chosen register values.

Yes sure. Userspace can easily fool the sanity checks in in_uprobe_trampoline().
This is a known issue. I think we don't care, and in fact IMO in_uprobe_trampoline()
can die.

At worst this can trigger a wrong a trace event, right? Nothing to fix, I think.

Oleg.

> 
> HEAD commit:    fe2ec83746e501645709761605c2464a44fd2929
> git tree:       upstream Linux checkout, local branch master
> source version: Linux 7.3.0-rc4-70-gfe2ec83746e50
> compiler:       gcc 11.4.0, GNU ld 2.38 (from the kernel build banner)
> 
> console output:
> https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/9eb4cfbf7c87bf4b06cd6138775a13814ded54c6/console-output.txt
> kernel config:
> https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b1d9a09b984075b425aab4875117a6766a795110/kernel-config.txt
> reproducer:
> https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b7e400345a004b4a4c340eccad862ac1f569aaee/poc.c
> 
> Build the PoC and run it in a disposable VM with tracefs mounted.  First print the file offsets for site1 and site2, then register and enable a uprobe event at each offset.  The forge mode executes site1 once to map the trampoline, then makes the forged syscall from a uid 65534 child:
> 
>     cc -static -no-pie -O1 -fno-ipa-icf -fno-stack-protector -o forge poc.c
>     mount -t tracefs tracefs /sys/kernel/tracing
>     cp forge /forge
>     /forge offsets
>     echo "p:uprobes/site1 /forge:OFFSET1" > /sys/kernel/tracing/uprobe_events
>     echo "p:uprobes/site2 /forge:OFFSET2" >> /sys/kernel/tracing/uprobe_events
>     echo 1 > /sys/kernel/tracing/events/uprobes/site1/enable
>     echo 1 > /sys/kernel/tracing/events/uprobes/site2/enable
>     echo > /sys/kernel/tracing/trace
>     /forge forge
>     cat /sys/kernel/tracing/trace
> 
> Replace OFFSET1 and OFFSET2 with the file_off1 and file_off2 values printed by /forge offsets.  Run as root for tracefs setup; the PoC drops its forged child to uid 65534.  
> 
> Two fresh boots emitted a trace event for registered site2, which was never executed, and reported attacker-chosen ax/r11/cx values.  Legitimate execution produced only site1; an unregistered offset produced no site2 event; calling uprobe without the trampoline returned EPROTO.
> 
> Impact and prerequisites:
> This falsifies tracing and profiling data for an enabled uprobe in the caller’s address space.  The evidence demonstrates event and register-value forgery, not kernel memory corruption, cross-process data disclosure, or privilege escalation.
> 
> A fix needs to authenticate the probe context before dispatching consumers.  Checking only the trampoline address is insufficient because that mapping is user-executable.
> 
> Validation: Two independent boots emitted a trace event for registered site2, which was never executed, with attacker-chosen register values.  Legitimate site1 execution, an unregistered offset, and a direct syscall without a mapped trampoline served as controls.
> 
> Thanks,
> 
> shaos
.> 

Re: [BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames

[Oleg Nesterov]

(resend with more CC's)

On 10/20, shaos wrote:
>
> The x86 uprobe syscall checks only that regs->ip lies somewhere in the caller's
> executable [uprobes-trampoline] VMA, then trusts ax, r11, cx and retaddr copied
> from the user stack.  A process can jump into that VMA with a fabricated frame
> and make an enabled uprobe report a hit at a site it never executed, with
> caller-chosen register values.

Yes sure. Userspace can easily fool the sanity checks in in_uprobe_trampoline().
This is a known issue. I think we don't care, and in fact IMO in_uprobe_trampoline()
can die.

At worst this can trigger a wrong a trace event, right? Nothing to fix, I think.

Oleg.

> 
> HEAD commit:    fe2ec83746e501645709761605c2464a44fd2929
> git tree:       upstream Linux checkout, local branch master
> source version: Linux 7.3.0-rc4-70-gfe2ec83746e50
> compiler:       gcc 11.4.0, GNU ld 2.38 (from the kernel build banner)
> 
> console output:
> https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/9eb4cfbf7c87bf4b06cd6138775a13814ded54c6/console-output.txt
> kernel config:
> https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b1d9a09b984075b425aab4875117a6766a795110/kernel-config.txt
> reproducer:
> https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b7e400345a004b4a4c340eccad862ac1f569aaee/poc.c
> 
> Build the PoC and run it in a disposable VM with tracefs mounted.  First print the file offsets for site1 and site2, then register and enable a uprobe event at each offset.  The forge mode executes site1 once to map the trampoline, then makes the forged syscall from a uid 65534 child:
> 
>     cc -static -no-pie -O1 -fno-ipa-icf -fno-stack-protector -o forge poc.c
>     mount -t tracefs tracefs /sys/kernel/tracing
>     cp forge /forge
>     /forge offsets
>     echo "p:uprobes/site1 /forge:OFFSET1" > /sys/kernel/tracing/uprobe_events
>     echo "p:uprobes/site2 /forge:OFFSET2" >> /sys/kernel/tracing/uprobe_events
>     echo 1 > /sys/kernel/tracing/events/uprobes/site1/enable
>     echo 1 > /sys/kernel/tracing/events/uprobes/site2/enable
>     echo > /sys/kernel/tracing/trace
>     /forge forge
>     cat /sys/kernel/tracing/trace
> 
> Replace OFFSET1 and OFFSET2 with the file_off1 and file_off2 values printed by /forge offsets.  Run as root for tracefs setup; the PoC drops its forged child to uid 65534.  
> 
> Two fresh boots emitted a trace event for registered site2, which was never executed, and reported attacker-chosen ax/r11/cx values.  Legitimate execution produced only site1; an unregistered offset produced no site2 event; calling uprobe without the trampoline returned EPROTO.
> 
> Impact and prerequisites:
> This falsifies tracing and profiling data for an enabled uprobe in the caller’s address space.  The evidence demonstrates event and register-value forgery, not kernel memory corruption, cross-process data disclosure, or privilege escalation.
> 
> A fix needs to authenticate the probe context before dispatching consumers.  Checking only the trampoline address is insufficient because that mapping is user-executable.
> 
> Validation: Two independent boots emitted a trace event for registered site2, which was never executed, with attacker-chosen register values.  Legitimate site1 execution, an unregistered offset, and a direct syscall without a mapped trampoline served as controls.
> 
> Thanks,
> 
> shaos
.> 

Re: [BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames

[Masami Hiramatsu]

Cc: Jiri,

On Tue, 20 Oct 2026 00:37:04 +0000, shaos <shawnq1@163.com> wrote:
> Hello,
> 
> The x86 uprobe syscall checks only that regs->ip lies somewhere in the
> caller's executable [uprobes-trampoline] VMA, then trusts ax, r11, cx
> and retaddr copied from the user stack.  A process can jump into that
> VMA with a fabricated frame and make an enabled uprobe report a hit at
> a site it never executed, with caller-chosen register values.

Thanks for reporting!
So, in short, would you mean user program can mimic to call uprobe syscall
if it can detect whether it is probed ? (Like shooting their foot by itself)

If this is a problem, I think we need to introduce a "reliable-binaries" list
and instruments uprobe syscall only for the reliable binaries.
(It may also need to check the integrity, but it depends user's operation.)

Thank you,

-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>