CVE-2023-52879
Linux Kernel Tracing vulnerablility in trace_event_file lead to Use-After-Free
Description
In the Linux kernel, the following vulnerability has been resolved: tracing: Have trace_event_file have ref counters The following can crash the kernel: # cd /sys/kernel/tracing # echo 'p:sched schedule' > kprobe_events # exec 5>>events/kprobes/sched/enable # > kprobe_events # exec 5>&- The above commands: 1. Change directory to the tracefs directory 2. Create a kprobe event (doesn't matter what one) 3. Open bash file descriptor 5 on the enable file of the kprobe event 4. Delete the kprobe event (removes the files too) 5. Close the bash file descriptor 5 The above causes a crash! BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 877 Comm: bash Not tainted 6.5.0-rc4-test-00008-g2c6b6b1029d4-dirty #186 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:tracing_release_file_tr+0xc/0x50 What happens here is that the kprobe event creates a trace_event_file "file" descriptor that represents the file in tracefs to the event. It maintains state of the event (is it enabled for the given instance?). Opening the "enable" file gets a reference to the event "file" descriptor via the open file descriptor. When the kprobe event is deleted, the file is also deleted from the tracefs system which also frees the event "file" descriptor. But as the tracefs file is still opened by user space, it will not be totally removed until the final dput() is called on it. But this is not true with the event "file" descriptor that is already freed. If the user does a write to or simply closes the file descriptor it will reference the event "file" descriptor that was just freed, causing a use-after-free bug. To solve this, add a ref count to the event "file" descriptor as well as a new flag called "FREED". The "file" will not be freed until the last reference is released. But the FREE flag will be set when the event is removed to prevent any more modifications to that event from happening, even if there's still a reference to the event "file" descriptor.
INFO
Published Date :
May 21, 2024, 4:15 p.m.
Last Modified :
Feb. 3, 2025, 3:46 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2023-52879.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2023-52879 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2023-52879 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Feb. 03, 2025
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE NIST CWE-476 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.4.258 up to (excluding) 5.4.262 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.10.198 up to (excluding) 5.10.202 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.15.134 up to (excluding) 5.15.140 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.55 up to (excluding) 6.1.64 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.5.5 up to (excluding) 6.5.13 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.6 up to (excluding) 6.6.1 Changed Reference Type https://git.kernel.org/stable/c/2c9de867ca285c397cd71af703763fe416265706 No Types Assigned https://git.kernel.org/stable/c/2c9de867ca285c397cd71af703763fe416265706 Patch Changed Reference Type https://git.kernel.org/stable/c/2c9de867ca285c397cd71af703763fe416265706 No Types Assigned https://git.kernel.org/stable/c/2c9de867ca285c397cd71af703763fe416265706 Patch Changed Reference Type https://git.kernel.org/stable/c/2fa74d29fc1899c237d51bf9a6e132ea5c488976 No Types Assigned https://git.kernel.org/stable/c/2fa74d29fc1899c237d51bf9a6e132ea5c488976 Patch Changed Reference Type https://git.kernel.org/stable/c/2fa74d29fc1899c237d51bf9a6e132ea5c488976 No Types Assigned https://git.kernel.org/stable/c/2fa74d29fc1899c237d51bf9a6e132ea5c488976 Patch Changed Reference Type https://git.kernel.org/stable/c/9034c87d61be8cff989017740a91701ac8195a1d No Types Assigned https://git.kernel.org/stable/c/9034c87d61be8cff989017740a91701ac8195a1d Patch Changed Reference Type https://git.kernel.org/stable/c/9034c87d61be8cff989017740a91701ac8195a1d No Types Assigned https://git.kernel.org/stable/c/9034c87d61be8cff989017740a91701ac8195a1d Patch Changed Reference Type https://git.kernel.org/stable/c/961c4511c7578d6b8f39118be919016ec3db1c1e No Types Assigned https://git.kernel.org/stable/c/961c4511c7578d6b8f39118be919016ec3db1c1e Patch Changed Reference Type https://git.kernel.org/stable/c/961c4511c7578d6b8f39118be919016ec3db1c1e No Types Assigned https://git.kernel.org/stable/c/961c4511c7578d6b8f39118be919016ec3db1c1e Patch Changed Reference Type https://git.kernel.org/stable/c/a98172e36e5f1b3d29ad71fade2d611cfcc2fe6f No Types Assigned https://git.kernel.org/stable/c/a98172e36e5f1b3d29ad71fade2d611cfcc2fe6f Patch Changed Reference Type https://git.kernel.org/stable/c/a98172e36e5f1b3d29ad71fade2d611cfcc2fe6f No Types Assigned https://git.kernel.org/stable/c/a98172e36e5f1b3d29ad71fade2d611cfcc2fe6f Patch Changed Reference Type https://git.kernel.org/stable/c/bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4 No Types Assigned https://git.kernel.org/stable/c/bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4 Patch Changed Reference Type https://git.kernel.org/stable/c/bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4 No Types Assigned https://git.kernel.org/stable/c/bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4 Patch Changed Reference Type https://git.kernel.org/stable/c/cbc7c29dff0fa18162f2a3889d82eeefd67305e0 No Types Assigned https://git.kernel.org/stable/c/cbc7c29dff0fa18162f2a3889d82eeefd67305e0 Patch Changed Reference Type https://git.kernel.org/stable/c/cbc7c29dff0fa18162f2a3889d82eeefd67305e0 No Types Assigned https://git.kernel.org/stable/c/cbc7c29dff0fa18162f2a3889d82eeefd67305e0 Patch -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/2c9de867ca285c397cd71af703763fe416265706 Added Reference https://git.kernel.org/stable/c/2fa74d29fc1899c237d51bf9a6e132ea5c488976 Added Reference https://git.kernel.org/stable/c/9034c87d61be8cff989017740a91701ac8195a1d Added Reference https://git.kernel.org/stable/c/961c4511c7578d6b8f39118be919016ec3db1c1e Added Reference https://git.kernel.org/stable/c/a98172e36e5f1b3d29ad71fade2d611cfcc2fe6f Added Reference https://git.kernel.org/stable/c/bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4 Added Reference https://git.kernel.org/stable/c/cbc7c29dff0fa18162f2a3889d82eeefd67305e0 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 29, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 21, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: tracing: Have trace_event_file have ref counters The following can crash the kernel: # cd /sys/kernel/tracing # echo 'p:sched schedule' > kprobe_events # exec 5>>events/kprobes/sched/enable # > kprobe_events # exec 5>&- The above commands: 1. Change directory to the tracefs directory 2. Create a kprobe event (doesn't matter what one) 3. Open bash file descriptor 5 on the enable file of the kprobe event 4. Delete the kprobe event (removes the files too) 5. Close the bash file descriptor 5 The above causes a crash! BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 877 Comm: bash Not tainted 6.5.0-rc4-test-00008-g2c6b6b1029d4-dirty #186 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:tracing_release_file_tr+0xc/0x50 What happens here is that the kprobe event creates a trace_event_file "file" descriptor that represents the file in tracefs to the event. It maintains state of the event (is it enabled for the given instance?). Opening the "enable" file gets a reference to the event "file" descriptor via the open file descriptor. When the kprobe event is deleted, the file is also deleted from the tracefs system which also frees the event "file" descriptor. But as the tracefs file is still opened by user space, it will not be totally removed until the final dput() is called on it. But this is not true with the event "file" descriptor that is already freed. If the user does a write to or simply closes the file descriptor it will reference the event "file" descriptor that was just freed, causing a use-after-free bug. To solve this, add a ref count to the event "file" descriptor as well as a new flag called "FREED". The "file" will not be freed until the last reference is released. But the FREE flag will be set when the event is removed to prevent any more modifications to that event from happening, even if there's still a reference to the event "file" descriptor. Added Reference kernel.org https://git.kernel.org/stable/c/961c4511c7578d6b8f39118be919016ec3db1c1e [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/a98172e36e5f1b3d29ad71fade2d611cfcc2fe6f [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/cbc7c29dff0fa18162f2a3889d82eeefd67305e0 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/2fa74d29fc1899c237d51bf9a6e132ea5c488976 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/2c9de867ca285c397cd71af703763fe416265706 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/9034c87d61be8cff989017740a91701ac8195a1d [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2023-52879 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2023-52879
weaknesses.