Re: [BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames

[Jiri Olsa <olsajiri@gmail.com>]

On Tue, Oct 20, 2026 at 09:42:25AM +0200, Oleg Nesterov wrote:
> (resend with more CC's)
> 
> On 10/20, shaos wrote:
> >
> > The x86 uprobe syscall checks only that regs->ip lies somewhere in the caller's
> > executable [uprobes-trampoline] VMA, then trusts ax, r11, cx and retaddr copied
> > from the user stack.  A process can jump into that VMA with a fabricated frame
> > and make an enabled uprobe report a hit at a site it never executed, with
> > caller-chosen register values.
> 
> Yes sure. Userspace can easily fool the sanity checks in in_uprobe_trampoline().
> This is a known issue. I think we don't care, and in fact IMO in_uprobe_trampoline()
> can die.
> 
> At worst this can trigger a wrong a trace event, right? Nothing to fix, I think.

+1 also I'm not sure what we could do about it

jirka

> 
> Oleg.
> 
> > 
> > HEAD commit:    fe2ec83746e501645709761605c2464a44fd2929
> > git tree:       upstream Linux checkout, local branch master
> > source version: Linux 7.3.0-rc4-70-gfe2ec83746e50
> > compiler:       gcc 11.4.0, GNU ld 2.38 (from the kernel build banner)
> > 
> > console output:
> > https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/9eb4cfbf7c87bf4b06cd6138775a13814ded54c6/console-output.txt
> > kernel config:
> > https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b1d9a09b984075b425aab4875117a6766a795110/kernel-config.txt
> > reproducer:
> > https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b7e400345a004b4a4c340eccad862ac1f569aaee/poc.c
> > 
> > Build the PoC and run it in a disposable VM with tracefs mounted.  First print the file offsets for site1 and site2, then register and enable a uprobe event at each offset.  The forge mode executes site1 once to map the trampoline, then makes the forged syscall from a uid 65534 child:
> > 
> >     cc -static -no-pie -O1 -fno-ipa-icf -fno-stack-protector -o forge poc.c
> >     mount -t tracefs tracefs /sys/kernel/tracing
> >     cp forge /forge
> >     /forge offsets
> >     echo "p:uprobes/site1 /forge:OFFSET1" > /sys/kernel/tracing/uprobe_events
> >     echo "p:uprobes/site2 /forge:OFFSET2" >> /sys/kernel/tracing/uprobe_events
> >     echo 1 > /sys/kernel/tracing/events/uprobes/site1/enable
> >     echo 1 > /sys/kernel/tracing/events/uprobes/site2/enable
> >     echo > /sys/kernel/tracing/trace
> >     /forge forge
> >     cat /sys/kernel/tracing/trace
> > 
> > Replace OFFSET1 and OFFSET2 with the file_off1 and file_off2 values printed by /forge offsets.  Run as root for tracefs setup; the PoC drops its forged child to uid 65534.  
> > 
> > Two fresh boots emitted a trace event for registered site2, which was never executed, and reported attacker-chosen ax/r11/cx values.  Legitimate execution produced only site1; an unregistered offset produced no site2 event; calling uprobe without the trampoline returned EPROTO.
> > 
> > Impact and prerequisites:
> > This falsifies tracing and profiling data for an enabled uprobe in the caller’s address space.  The evidence demonstrates event and register-value forgery, not kernel memory corruption, cross-process data disclosure, or privilege escalation.
> > 
> > A fix needs to authenticate the probe context before dispatching consumers.  Checking only the trampoline address is insufficient because that mapping is user-executable.
> > 
> > Validation: Two independent boots emitted a trace event for registered site2, which was never executed, with attacker-chosen register values.  Legitimate site1 execution, an unregistered offset, and a direct syscall without a mapped trampoline served as controls.
> > 
> > Thanks,
> > 
> > shaos
> .> 
>