{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-53478", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-10-01T11:39:39.401Z", "datePublished": "2025-10-01T11:42:47.185Z", "dateUpdated": "2026-08-05T09:14:16.799Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:14:16.799Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/synthetic: Fix races on freeing last_cmd\n\nCurrently, the \"last_cmd\" variable can be accessed by multiple processes\nasynchronously when multiple users manipulate synthetic_events node\nat the same time, it could lead to use-after-free or double-free.\n\nThis patch add \"lastcmd_mutex\" to prevent \"last_cmd\" from being accessed\nasynchronously.\n\n================================================================\n\nIt's easy to reproduce in the KASAN environment by running the two\nscripts below in different shells.\n\nscript 1:\n while :\n do\n echo -n -e '\\x88' > /sys/kernel/tracing/synthetic_events\n done\n\nscript 2:\n while :\n do\n echo -n -e '\\xb0' > /sys/kernel/tracing/synthetic_events\n done\n\n================================================================\ndouble-free scenario:\n\n process A process B\n------------------- ---------------\n1.kstrdup last_cmd\n 2.free last_cmd\n3.free last_cmd(double-free)\n\n================================================================\nuse-after-free scenario:\n\n process A process B\n------------------- ---------------\n1.kstrdup last_cmd\n 2.free last_cmd\n3.tracing_log_err(use-after-free)\n\n================================================================\n\nAppendix 1. KASAN report double-free:\n\nBUG: KASAN: double-free in kfree+0xdc/0x1d4\nFree of addr ***** by task sh/4879\nCall trace:\n ...\n kfree+0xdc/0x1d4\n create_or_delete_synth_event+0x60/0x1e8\n trace_parse_run_command+0x2bc/0x4b8\n synth_events_write+0x20/0x30\n vfs_write+0x200/0x830\n ...\n\nAllocated by task 4879:\n ...\n kstrdup+0x5c/0x98\n create_or_delete_synth_event+0x6c/0x1e8\n trace_parse_run_command+0x2bc/0x4b8\n synth_events_write+0x20/0x30\n vfs_write+0x200/0x830\n ...\n\nFreed by task 5464:\n ...\n kfree+0xdc/0x1d4\n create_or_delete_synth_event+0x60/0x1e8\n trace_parse_run_command+0x2bc/0x4b8\n synth_events_write+0x20/0x30\n vfs_write+0x200/0x830\n ...\n\n================================================================\nAppendix 2. KASAN report use-after-free:\n\nBUG: KASAN: use-after-free in strlen+0x5c/0x7c\nRead of size 1 at addr ***** by task sh/5483\nsh: CPU: 7 PID: 5483 Comm: sh\n ...\n __asan_report_load1_noabort+0x34/0x44\n strlen+0x5c/0x7c\n tracing_log_err+0x60/0x444\n create_or_delete_synth_event+0xc4/0x204\n trace_parse_run_command+0x2bc/0x4b8\n synth_events_write+0x20/0x30\n vfs_write+0x200/0x830\n ...\n\nAllocated by task 5483:\n ...\n kstrdup+0x5c/0x98\n create_or_delete_synth_event+0x80/0x204\n trace_parse_run_command+0x2bc/0x4b8\n synth_events_write+0x20/0x30\n vfs_write+0x200/0x830\n ...\n\nFreed by task 5480:\n ...\n kfree+0xdc/0x1d4\n create_or_delete_synth_event+0x74/0x204\n trace_parse_run_command+0x2bc/0x4b8\n synth_events_write+0x20/0x30\n vfs_write+0x200/0x830\n ..." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is triggered only by write() to the tracefs node /sys/kernel/tracing/synthetic_events (or dynamic_events), which requires local access to the machine's filesystem. There is no network-facing consumer of this code path.\nAC:L - Although it is a race, the attacker owns both sides — simply running two concurrent writers of malformed commands, exactly as the reporter's two-shell reproducer does, and the commit states it reproduces easily. Object size and contents of the raced allocation are fully attacker-chosen, so no condition lies outside the attacker's control.\nPR:L - No capability check exists in the path; access is gated only by DAC on the tracefs file, and tracefs's gid= mount option is explicitly provided so a non-root tracing group (Android/ChromeOS/developer-group deployments) can write these nodes. An unprivileged member of that group can trigger the race with plain writes.\nUI:N - The attacker performs the entire attack with its own write() calls; no victim action, mount, or file-open by another user is needed.\nS:U - The corruption occurs in kernel slab memory and its impact stays within the same kernel security authority, with no crossing of a hypervisor, IOMMU, or sandbox boundary.\nC:H - The use-after-free reads freed heap memory via strlen()/snprintf() in tracing_log_err() and copies it into err->cmd, which userspace can then read back from tracing/error_log — a direct kernel heap infoleak. Combined with the double-free's ability to overlap allocations, arbitrary kernel memory disclosure is achievable.\nI:H - The double-free frees an attacker-sized, attacker-filled kmalloc object twice, corrupting the SLUB freelist and letting two live allocations alias the same memory — a well-known route to arbitrary kernel write and control-flow hijack.\nA:H - The double-free and use-after-free readily produce slab corruption, KASAN BUG reports, and kernel panics, and the race can be re-triggered in a tight loop to reliably crash the system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/trace/trace_events_synth.c" ], "versions": [ { "version": "27c888da9867725784bad3d6455d6e53b425fa2b", "lessThan": "9fe183f659a2704255e5d84f6ae308c234a113ec", "status": "affected", "versionType": "git" }, { "version": "27c888da9867725784bad3d6455d6e53b425fa2b", "lessThan": "8826d9e7bd51e7656f78baa4472e8e2f5e7069f0", "status": "affected", "versionType": "git" }, { "version": "27c888da9867725784bad3d6455d6e53b425fa2b", "lessThan": "4ccf11c4e8a8e051499d53a12f502196c97a758e", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/trace/trace_events_synth.c" ], "versions": [ { "version": "5.18", "status": "affected" }, { "version": "0", "lessThan": "5.18", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.24", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.2.11", "lessThanOrEqual": "6.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.1.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.2.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.18", "versionEndExcluding": "6.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/9fe183f659a2704255e5d84f6ae308c234a113ec" }, { "url": "https://git.kernel.org/stable/c/8826d9e7bd51e7656f78baa4472e8e2f5e7069f0" }, { "url": "https://git.kernel.org/stable/c/4ccf11c4e8a8e051499d53a12f502196c97a758e" } ], "title": "tracing/synthetic: Fix races on freeing last_cmd", "x_generator": { "engine": "bippy-1.2.0" } } } }