* [BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames
@ 2026-10-20 0:37 shaos
2026-10-20 7:39 ` Oleg Nesterov
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: shaos @ 2026-10-20 0:37 UTC (permalink / raw)
To: mhiramat; +Cc: Oleg Nesterov, Peter Zijlstra, x86, linux-kernel
Hello,
The x86 uprobe syscall checks only that regs->ip lies somewhere in the caller's executable [uprobes-trampoline] VMA, then trusts ax, r11, cx and retaddr copied from the user stack. A process can jump into that VMA with a fabricated frame and make an enabled uprobe report a hit at a site it never executed, with caller-chosen register values.
HEAD commit: fe2ec83746e501645709761605c2464a44fd2929
git tree: upstream Linux checkout, local branch master
source version: Linux 7.3.0-rc4-70-gfe2ec83746e50
compiler: gcc 11.4.0, GNU ld 2.38 (from the kernel build banner)
console output:
https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/9eb4cfbf7c87bf4b06cd6138775a13814ded54c6/console-output.txt
kernel config:
https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b1d9a09b984075b425aab4875117a6766a795110/kernel-config.txt
reproducer:
https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b7e400345a004b4a4c340eccad862ac1f569aaee/poc.c
Build the PoC and run it in a disposable VM with tracefs mounted. First print the file offsets for site1 and site2, then register and enable a uprobe event at each offset. The forge mode executes site1 once to map the trampoline, then makes the forged syscall from a uid 65534 child:
cc -static -no-pie -O1 -fno-ipa-icf -fno-stack-protector -o forge poc.c
mount -t tracefs tracefs /sys/kernel/tracing
cp forge /forge
/forge offsets
echo "p:uprobes/site1 /forge:OFFSET1" > /sys/kernel/tracing/uprobe_events
echo "p:uprobes/site2 /forge:OFFSET2" >> /sys/kernel/tracing/uprobe_events
echo 1 > /sys/kernel/tracing/events/uprobes/site1/enable
echo 1 > /sys/kernel/tracing/events/uprobes/site2/enable
echo > /sys/kernel/tracing/trace
/forge forge
cat /sys/kernel/tracing/trace
Replace OFFSET1 and OFFSET2 with the file_off1 and file_off2 values printed by /forge offsets. Run as root for tracefs setup; the PoC drops its forged child to uid 65534.
Two fresh boots emitted a trace event for registered site2, which was never executed, and reported attacker-chosen ax/r11/cx values. Legitimate execution produced only site1; an unregistered offset produced no site2 event; calling uprobe without the trampoline returned EPROTO.
Impact and prerequisites:
This falsifies tracing and profiling data for an enabled uprobe in the caller’s address space. The evidence demonstrates event and register-value forgery, not kernel memory corruption, cross-process data disclosure, or privilege escalation.
A fix needs to authenticate the probe context before dispatching consumers. Checking only the trampoline address is insufficient because that mapping is user-executable.
Validation: Two independent boots emitted a trace event for registered site2, which was never executed, with attacker-chosen register values. Legitimate site1 execution, an unregistered offset, and a direct syscall without a mapped trampoline served as controls.
Thanks,
shaos
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames
2026-10-20 0:37 [BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames shaos
@ 2026-10-20 7:39 ` Oleg Nesterov
2026-10-20 7:42 ` Oleg Nesterov
2026-10-20 7:48 ` Masami Hiramatsu
2 siblings, 0 replies; 5+ messages in thread
From: Oleg Nesterov @ 2026-10-20 7:39 UTC (permalink / raw)
To: shaos; +Cc: mhiramat, Peter Zijlstra, x86, linux-kernel
On 10/20, shaos wrote:
>
> The x86 uprobe syscall checks only that regs->ip lies somewhere in the caller's
> executable [uprobes-trampoline] VMA, then trusts ax, r11, cx and retaddr copied
> from the user stack. A process can jump into that VMA with a fabricated frame
> and make an enabled uprobe report a hit at a site it never executed, with
> caller-chosen register values.
Yes sure. Userspace can easily fool the sanity checks in in_uprobe_trampoline().
This is a known issue. I think we don't care, and in fact IMO in_uprobe_trampoline()
can die.
At worst this can trigger a wrong a trace event, right? Nothing to fix, I think.
Oleg.
>
> HEAD commit: fe2ec83746e501645709761605c2464a44fd2929
> git tree: upstream Linux checkout, local branch master
> source version: Linux 7.3.0-rc4-70-gfe2ec83746e50
> compiler: gcc 11.4.0, GNU ld 2.38 (from the kernel build banner)
>
> console output:
> https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/9eb4cfbf7c87bf4b06cd6138775a13814ded54c6/console-output.txt
> kernel config:
> https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b1d9a09b984075b425aab4875117a6766a795110/kernel-config.txt
> reproducer:
> https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b7e400345a004b4a4c340eccad862ac1f569aaee/poc.c
>
> Build the PoC and run it in a disposable VM with tracefs mounted. First print the file offsets for site1 and site2, then register and enable a uprobe event at each offset. The forge mode executes site1 once to map the trampoline, then makes the forged syscall from a uid 65534 child:
>
> cc -static -no-pie -O1 -fno-ipa-icf -fno-stack-protector -o forge poc.c
> mount -t tracefs tracefs /sys/kernel/tracing
> cp forge /forge
> /forge offsets
> echo "p:uprobes/site1 /forge:OFFSET1" > /sys/kernel/tracing/uprobe_events
> echo "p:uprobes/site2 /forge:OFFSET2" >> /sys/kernel/tracing/uprobe_events
> echo 1 > /sys/kernel/tracing/events/uprobes/site1/enable
> echo 1 > /sys/kernel/tracing/events/uprobes/site2/enable
> echo > /sys/kernel/tracing/trace
> /forge forge
> cat /sys/kernel/tracing/trace
>
> Replace OFFSET1 and OFFSET2 with the file_off1 and file_off2 values printed by /forge offsets. Run as root for tracefs setup; the PoC drops its forged child to uid 65534.
>
> Two fresh boots emitted a trace event for registered site2, which was never executed, and reported attacker-chosen ax/r11/cx values. Legitimate execution produced only site1; an unregistered offset produced no site2 event; calling uprobe without the trampoline returned EPROTO.
>
> Impact and prerequisites:
> This falsifies tracing and profiling data for an enabled uprobe in the caller’s address space. The evidence demonstrates event and register-value forgery, not kernel memory corruption, cross-process data disclosure, or privilege escalation.
>
> A fix needs to authenticate the probe context before dispatching consumers. Checking only the trampoline address is insufficient because that mapping is user-executable.
>
> Validation: Two independent boots emitted a trace event for registered site2, which was never executed, with attacker-chosen register values. Legitimate site1 execution, an unregistered offset, and a direct syscall without a mapped trampoline served as controls.
>
> Thanks,
>
> shaos
.>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames
2026-10-20 0:37 [BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames shaos
2026-10-20 7:39 ` Oleg Nesterov
@ 2026-10-20 7:42 ` Oleg Nesterov
2026-10-20 15:59 ` Jiri Olsa
2026-10-20 7:48 ` Masami Hiramatsu
2 siblings, 1 reply; 5+ messages in thread
From: Oleg Nesterov @ 2026-10-20 7:42 UTC (permalink / raw)
To: shaos, Jiri Olsa, Andrii Nakryiko
Cc: mhiramat, Peter Zijlstra, x86, linux-kernel
(resend with more CC's)
On 10/20, shaos wrote:
>
> The x86 uprobe syscall checks only that regs->ip lies somewhere in the caller's
> executable [uprobes-trampoline] VMA, then trusts ax, r11, cx and retaddr copied
> from the user stack. A process can jump into that VMA with a fabricated frame
> and make an enabled uprobe report a hit at a site it never executed, with
> caller-chosen register values.
Yes sure. Userspace can easily fool the sanity checks in in_uprobe_trampoline().
This is a known issue. I think we don't care, and in fact IMO in_uprobe_trampoline()
can die.
At worst this can trigger a wrong a trace event, right? Nothing to fix, I think.
Oleg.
>
> HEAD commit: fe2ec83746e501645709761605c2464a44fd2929
> git tree: upstream Linux checkout, local branch master
> source version: Linux 7.3.0-rc4-70-gfe2ec83746e50
> compiler: gcc 11.4.0, GNU ld 2.38 (from the kernel build banner)
>
> console output:
> https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/9eb4cfbf7c87bf4b06cd6138775a13814ded54c6/console-output.txt
> kernel config:
> https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b1d9a09b984075b425aab4875117a6766a795110/kernel-config.txt
> reproducer:
> https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b7e400345a004b4a4c340eccad862ac1f569aaee/poc.c
>
> Build the PoC and run it in a disposable VM with tracefs mounted. First print the file offsets for site1 and site2, then register and enable a uprobe event at each offset. The forge mode executes site1 once to map the trampoline, then makes the forged syscall from a uid 65534 child:
>
> cc -static -no-pie -O1 -fno-ipa-icf -fno-stack-protector -o forge poc.c
> mount -t tracefs tracefs /sys/kernel/tracing
> cp forge /forge
> /forge offsets
> echo "p:uprobes/site1 /forge:OFFSET1" > /sys/kernel/tracing/uprobe_events
> echo "p:uprobes/site2 /forge:OFFSET2" >> /sys/kernel/tracing/uprobe_events
> echo 1 > /sys/kernel/tracing/events/uprobes/site1/enable
> echo 1 > /sys/kernel/tracing/events/uprobes/site2/enable
> echo > /sys/kernel/tracing/trace
> /forge forge
> cat /sys/kernel/tracing/trace
>
> Replace OFFSET1 and OFFSET2 with the file_off1 and file_off2 values printed by /forge offsets. Run as root for tracefs setup; the PoC drops its forged child to uid 65534.
>
> Two fresh boots emitted a trace event for registered site2, which was never executed, and reported attacker-chosen ax/r11/cx values. Legitimate execution produced only site1; an unregistered offset produced no site2 event; calling uprobe without the trampoline returned EPROTO.
>
> Impact and prerequisites:
> This falsifies tracing and profiling data for an enabled uprobe in the caller’s address space. The evidence demonstrates event and register-value forgery, not kernel memory corruption, cross-process data disclosure, or privilege escalation.
>
> A fix needs to authenticate the probe context before dispatching consumers. Checking only the trampoline address is insufficient because that mapping is user-executable.
>
> Validation: Two independent boots emitted a trace event for registered site2, which was never executed, with attacker-chosen register values. Legitimate site1 execution, an unregistered offset, and a direct syscall without a mapped trampoline served as controls.
>
> Thanks,
>
> shaos
.>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames
2026-10-20 0:37 [BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames shaos
2026-10-20 7:39 ` Oleg Nesterov
2026-10-20 7:42 ` Oleg Nesterov
@ 2026-10-20 7:48 ` Masami Hiramatsu
2 siblings, 0 replies; 5+ messages in thread
From: Masami Hiramatsu @ 2026-10-20 7:48 UTC (permalink / raw)
To: shaos; +Cc: Oleg Nesterov, Peter Zijlstra, x86, linux-kernel, Jiri Olsa
Cc: Jiri,
On Tue, 20 Oct 2026 00:37:04 +0000, shaos <shawnq1@163.com> wrote:
> Hello,
>
> The x86 uprobe syscall checks only that regs->ip lies somewhere in the
> caller's executable [uprobes-trampoline] VMA, then trusts ax, r11, cx
> and retaddr copied from the user stack. A process can jump into that
> VMA with a fabricated frame and make an enabled uprobe report a hit at
> a site it never executed, with caller-chosen register values.
Thanks for reporting!
So, in short, would you mean user program can mimic to call uprobe syscall
if it can detect whether it is probed ? (Like shooting their foot by itself)
If this is a problem, I think we need to introduce a "reliable-binaries" list
and instruments uprobe syscall only for the reliable binaries.
(It may also need to check the integrity, but it depends user's operation.)
Thank you,
--
Masami Hiramatsu (Google) <mhiramat@kernel.org>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames
2026-10-20 7:42 ` Oleg Nesterov
@ 2026-10-20 15:59 ` Jiri Olsa
0 siblings, 0 replies; 5+ messages in thread
From: Jiri Olsa @ 2026-10-20 15:59 UTC (permalink / raw)
To: Oleg Nesterov
Cc: shaos, Andrii Nakryiko, mhiramat, Peter Zijlstra, x86, linux-kernel
On Tue, Oct 20, 2026 at 09:42:25AM +0200, Oleg Nesterov wrote:
> (resend with more CC's)
>
> On 10/20, shaos wrote:
> >
> > The x86 uprobe syscall checks only that regs->ip lies somewhere in the caller's
> > executable [uprobes-trampoline] VMA, then trusts ax, r11, cx and retaddr copied
> > from the user stack. A process can jump into that VMA with a fabricated frame
> > and make an enabled uprobe report a hit at a site it never executed, with
> > caller-chosen register values.
>
> Yes sure. Userspace can easily fool the sanity checks in in_uprobe_trampoline().
> This is a known issue. I think we don't care, and in fact IMO in_uprobe_trampoline()
> can die.
>
> At worst this can trigger a wrong a trace event, right? Nothing to fix, I think.
+1 also I'm not sure what we could do about it
jirka
>
> Oleg.
>
> >
> > HEAD commit: fe2ec83746e501645709761605c2464a44fd2929
> > git tree: upstream Linux checkout, local branch master
> > source version: Linux 7.3.0-rc4-70-gfe2ec83746e50
> > compiler: gcc 11.4.0, GNU ld 2.38 (from the kernel build banner)
> >
> > console output:
> > https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/9eb4cfbf7c87bf4b06cd6138775a13814ded54c6/console-output.txt
> > kernel config:
> > https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b1d9a09b984075b425aab4875117a6766a795110/kernel-config.txt
> > reproducer:
> > https://gist.githubusercontent.com/shaos26/82a14d478c3e5b27d81713f9989693cd/raw/b7e400345a004b4a4c340eccad862ac1f569aaee/poc.c
> >
> > Build the PoC and run it in a disposable VM with tracefs mounted. First print the file offsets for site1 and site2, then register and enable a uprobe event at each offset. The forge mode executes site1 once to map the trampoline, then makes the forged syscall from a uid 65534 child:
> >
> > cc -static -no-pie -O1 -fno-ipa-icf -fno-stack-protector -o forge poc.c
> > mount -t tracefs tracefs /sys/kernel/tracing
> > cp forge /forge
> > /forge offsets
> > echo "p:uprobes/site1 /forge:OFFSET1" > /sys/kernel/tracing/uprobe_events
> > echo "p:uprobes/site2 /forge:OFFSET2" >> /sys/kernel/tracing/uprobe_events
> > echo 1 > /sys/kernel/tracing/events/uprobes/site1/enable
> > echo 1 > /sys/kernel/tracing/events/uprobes/site2/enable
> > echo > /sys/kernel/tracing/trace
> > /forge forge
> > cat /sys/kernel/tracing/trace
> >
> > Replace OFFSET1 and OFFSET2 with the file_off1 and file_off2 values printed by /forge offsets. Run as root for tracefs setup; the PoC drops its forged child to uid 65534.
> >
> > Two fresh boots emitted a trace event for registered site2, which was never executed, and reported attacker-chosen ax/r11/cx values. Legitimate execution produced only site1; an unregistered offset produced no site2 event; calling uprobe without the trampoline returned EPROTO.
> >
> > Impact and prerequisites:
> > This falsifies tracing and profiling data for an enabled uprobe in the caller’s address space. The evidence demonstrates event and register-value forgery, not kernel memory corruption, cross-process data disclosure, or privilege escalation.
> >
> > A fix needs to authenticate the probe context before dispatching consumers. Checking only the trampoline address is insufficient because that mapping is user-executable.
> >
> > Validation: Two independent boots emitted a trace event for registered site2, which was never executed, with attacker-chosen register values. Legitimate site1 execution, an unregistered offset, and a direct syscall without a mapped trampoline served as controls.
> >
> > Thanks,
> >
> > shaos
> .>
>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-10-20 15:59 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-20 0:37 [BUG] uprobes/x86: uprobe syscall accepts forged trampoline frames shaos
2026-10-20 7:39 ` Oleg Nesterov
2026-10-20 7:42 ` Oleg Nesterov
2026-10-20 15:59 ` Jiri Olsa
2026-10-20 7:48 ` Masami Hiramatsu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®