Race Against Time in the Kernel’s Clockwork

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://streypaws.github.io/posts/Race-Against-Time-in-the-Kernel-Clockwork/
• Blog Title: Race Against Time in the Kernel’s Clockwork
• Suggested Section: Linux Privilege Escalation -> Linux Kernel Exploitation (Race Conditions/TOCTOU) -> POSIX CPU Timers (CVE-2025-38352)

🎯 Content Summary

CVE-2025-38352 — TOCTOU race in Linux/Android posix-cpu-timers that corrupts timer state when an exiting task processes expiries in IRQ context while another thread deletes the same timer. This can crash the kernel and, in some scenarios, be steered toward privilege escalation. Affected file: kernel/time/posix-cpu-timers.c.

How POSIX CPU timers work (concise internals you need for exploitation)
• Three CPU clock types (read by cpu_clock_...

🔧 Technical Details

Abstracted race technique: expiry vs. deletion under task exit
Force CPU-timer expiry for a victim thread while it is exiting and ensure the kernel takes the IRQ-context path (i.e., CONFIG_POSIX_CPU_TIMERS_TASK_WORK=n). The expiry path sets ctmr->firing=1 and then drops sighand. Concurrently invoke the timer’s delete operation from another thread. Because task lookup/locking may fail during exit, the delete path can skip the usual in‑flight guard (if (timer->it.cpu.firing)), causing inconsistent state during delivery. The core trick is to exploit the small window between unlock_task_sighand() and the firing loop to make deletion proceed as if not in flight.

🤖 Agent Actions

I analyzed the blog and the HackTricks repository, and found no existing page covering Linux kernel POSIX CPU timers race conditions. The content is highly technical and directly relevant, so I:

• Created a new page in the Linux privilege escalation section to document the TOCTOU race in POSIX CPU timers (CVE-2025-38352) with internals, root cause, triggering strategy, detection/hardening, and references.
• Linked the new page from the main Linux Privilege Escalation README under the Kernel exploits section.

Summary of changes implemented:

• New page:
  • Path: src/linux-hardening/privilege-escalation/linux-kernel-exploitation/posix-cpu-timers-toctou-cve-2025-38352.md
  • Includes:
    • Concise internals necessary for exploitation (cpu_clock_sample, posix_cpu_timer_create, arm_timer, fastpath, collect_timerqueue, run_posix_cpu_timers modes, handle_posix_cpu_timers).
    • Root cause sequence: expiry in IRQ context vs timer deletion during task exit leading to missing in-flight guard and state corruption.
    • Why CONFIG_POSIX_CPU_TIMERS_TASK_WORK is safe and the Android common kernel fix (tsk->exit_state early return).
    • Triggering strategy: ensure TASK_WORK=n, set up CPU timers (CLOCK_THREAD_CPUTIME_ID / CLOCK_PROCESS_CPUTIME_ID), high-frequency expiries, concurrent timer_delete, and target thread exit.
    • Detection/hardening recommendations.
    • Audit hotspots.
    • References to the blog, Android bulletin, and the patch commit.
• Updated existing file:
  • src/linux-hardening/privilege-escalation/README.md
    • Added a short note with an internal reference to the new page under “Kernel exploits”.

References added:

• Race Against Time in the Kernel’s Clockwork (StreyPaws)
• Android Security Bulletin – September 2025
• Android common kernel patch commit (157f357d50b5…)

No other similar content existed in the repository, so a new page was necessary and it’s properly linked from a related, high-visibility location.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 877
• MD files fixed: 1

All .md files have been checked for proper formatting (headers, includes, etc.).

🗑️ File Cleanup

• searchindex.js removed: This auto-generated file has been removed to prevent conflicts.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://streypaws.github.io/posts/Race-Against-Time-in-the-Kernel-Clockwork/

Content Categories: Based on the analysis, this content was categorized under "Linux Privilege Escalation -> Linux Kernel Exploitation (Race Conditions/TOCTOU) -> POSIX CPU Timers (CVE-2025-38352)".

Repository Maintenance:

• MD Files Formatting: 877 files processed (1 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0