Re: [PATCH v2] entry: Fix seccomp bypass after ptrace with TSYNC

[Oleg Nesterov]

On 07/13, Jinjie Ruan wrote:
>
> Sashiko review pointed out the following issue.
>
> If a thread is stopped in syscall_trace_enter() for ptrace, another
> thread can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC
> (e.g., via seccomp_attach_filter()). This will successfully set
> SYSCALL_WORK_SECCOMP on the stopped thread, but syscall_trace_enter()
> evaluates a cached 'work' variable sampled on entry. Consequently,
> the subsequent check for SYSCALL_WORK_SECCOMP misses the newly
> assigned flag, and the filter is silently bypassed.
>
> This race condition could allow an unprivileged process to execute
> a prohibited system call (e.g., execve) that the newly installed filter
> was intended to block, especially since the tracer might have modified
> the system call number during the ptrace stop.
>
> Fix this by re-reading the syscall_work flags after ptrace handling,
> so that any new SYSCALL_WORK_SECCOMP flag set by another thread via
> TSYNC during the ptrace stop is observed before the subsequent
> seccomp check.

I agree with this patch, but SECCOMP_FILTER_FLAG_TSYNC can also happen
after syscall_trace_enter() re-reads ->syscall_work ?

And this race is possible even without ptrace, SECCOMP_FILTER_FLAG_TSYNC
from another thread can happen after syscall_enter_from_user_mode_work()
reads ->syscall_work ?

I think we don't really care, but I don't understand the security concerns.
If debugger controls the process before it installs the seccomp filters, it
can simply nack sys_seccomp().

In short, does CVE-2026-89603 make real sense?

Oleg.

> --- a/include/linux/entry-common.h
> +++ b/include/linux/entry-common.h
> @@ -97,6 +97,9 @@ static __always_inline long syscall_trace_enter(struct pt_regs *regs, unsigned l
>  		if (!arch_ptrace_report_syscall_permit_entry(regs) ||
>  		    (work & SYSCALL_WORK_SYSCALL_EMU))
>  			return -1L;
> +
> +		/* ptrace might have changed work flags */
> +		work = READ_ONCE(current_thread_info()->syscall_work);
>  	}
>
>  	/* Do seccomp after ptrace, to catch any tracer changes. */
> --
> 2.34.1
>