CVE-2023-53478 — tracing/synthetic: Fix races on freeing last_cmd

Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

tracing/synthetic: Fix races on freeing last_cmd

Currently, the "last_cmd" variable can be accessed by multiple processes asynchronously when multiple users manipulate synthetic_events node at the same time, it could lead to use-after-free or double-free.

This patch add "lastcmd_mutex" to prevent "last_cmd" from being accessed asynchronously.

================================================================

It's easy to reproduce in the KASAN environment by running the two scripts below in different shells.

script 1: while : do echo -n -e '\x88' > /sys/kernel/tracing/synthetic_events done

script 2: while : do echo -n -e '\xb0' > /sys/kernel/tracing/synthetic_events done

================================================================ double-free scenario:

process A process B ------------------- --------------- 1.kstrdup last_cmd 2.free last_cmd 3.free last_cmd(double-free)

================================================================ use-after-free scenario:

process A process B ------------------- --------------- 1.kstrdup last_cmd 2.free last_cmd 3.tracing_log_err(use-after-free)

================================================================

Appendix 1. KASAN report…

Most recent entries from all

CVE-2023-53478 — tracing/synthetic: Fix races on freeing last_cmd