CVE-2023-53709 (GCVE-0-2023-53709)
Vulnerability from cvelistv5
Published
2025-10-22 13:23
Modified
2025-10-22 13:23
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Handle race between rb_move_tail and rb_check_pages It seems a data race between ring_buffer writing and integrity check. That is, RB_FLAG of head_page is been updating, while at same time RB_FLAG was cleared when doing integrity check rb_check_pages(): rb_check_pages() rb_handle_head_page(): -------- -------- rb_head_page_deactivate() rb_head_page_set_normal() rb_head_page_activate() We do intergrity test of the list to check if the list is corrupted and it is still worth doing it. So, let's refactor rb_check_pages() such that we no longer clear and set flag during the list sanity checking. [1] and [2] are the test to reproduce and the crash report respectively. 1: ``` read_trace.sh while true; do # the "trace" file is closed after read head -1 /sys/kernel/tracing/trace > /dev/null done ``` ``` repro.sh sysctl -w kernel.panic_on_warn=1 # function tracer will writing enough data into ring_buffer echo function > /sys/kernel/tracing/current_tracer ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ``` 2: ------------[ cut here ]------------ WARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653 rb_move_tail+0x450/0x470 Modules linked in: CPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G W 6.2.0-rc6+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:rb_move_tail+0x450/0x470 Code: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24 83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 <0f> 0b 83 f8 02 0f 84 ce fb ff ff e9 db RSP: 0018:ffffb5564089bd00 EFLAGS: 00000203 RAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18 RDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400 RBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2 R10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000 R13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108 FS: 0000000000000000(0000) GS:ffff9db3bdcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0 Call Trace: <TASK> ring_buffer_lock_reserve+0x136/0x360 ? __do_softirq+0x287/0x2df ? __pfx_rcu_softirq_qs+0x10/0x10 trace_function+0x21/0x110 ? __pfx_rcu_softirq_qs+0x10/0x10 ? __do_softirq+0x287/0x2df function_trace_call+0xf6/0x120 0xffffffffc038f097 ? rcu_softirq_qs+0x5/0x140 rcu_softirq_qs+0x5/0x140 __do_softirq+0x287/0x2df run_ksoftirqd+0x2a/0x30 smpboot_thread_fn+0x188/0x220 ? __pfx_smpboot_thread_fn+0x10/0x10 kthread+0xe7/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK> ---[ end trace 0000000000000000 ]--- [ crash report and test reproducer credit goes to Zheng Yejian]
References
Impacted products
Vendor Product Version
Linux Linux Version: 1039221cc2787dee51a7ffbf9b0e79d192dadf76
Version: 1039221cc2787dee51a7ffbf9b0e79d192dadf76
Version: 1039221cc2787dee51a7ffbf9b0e79d192dadf76
Version: 1039221cc2787dee51a7ffbf9b0e79d192dadf76
Version: 1039221cc2787dee51a7ffbf9b0e79d192dadf76
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6e02a43acd0691791df79ce538f2dd497a6c9b76",
              "status": "affected",
              "version": "1039221cc2787dee51a7ffbf9b0e79d192dadf76",
              "versionType": "git"
            },
            {
              "lessThan": "d41db100bc386b9433a3fc87026f5e8b453653e3",
              "status": "affected",
              "version": "1039221cc2787dee51a7ffbf9b0e79d192dadf76",
              "versionType": "git"
            },
            {
              "lessThan": "9674390ac540ed06768e3fbc2dba553929fbd736",
              "status": "affected",
              "version": "1039221cc2787dee51a7ffbf9b0e79d192dadf76",
              "versionType": "git"
            },
            {
              "lessThan": "09b1bf25f7f7a8f2bf8cd4278bba9c3172db8013",
              "status": "affected",
              "version": "1039221cc2787dee51a7ffbf9b0e79d192dadf76",
              "versionType": "git"
            },
            {
              "lessThan": "8843e06f67b14f71c044bf6267b2387784c7e198",
              "status": "affected",
              "version": "1039221cc2787dee51a7ffbf9b0e79d192dadf76",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/ring_buffer.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.173",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.99",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.173",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.99",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.16",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.3",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Handle race between rb_move_tail and rb_check_pages\n\nIt seems a data race between ring_buffer writing and integrity check.\nThat is, RB_FLAG of head_page is been updating, while at same time\nRB_FLAG was cleared when doing integrity check rb_check_pages():\n\n  rb_check_pages()            rb_handle_head_page():\n  --------                    --------\n  rb_head_page_deactivate()\n                              rb_head_page_set_normal()\n  rb_head_page_activate()\n\nWe do intergrity test of the list to check if the list is corrupted and\nit is still worth doing it. So, let\u0027s refactor rb_check_pages() such that\nwe no longer clear and set flag during the list sanity checking.\n\n[1] and [2] are the test to reproduce and the crash report respectively.\n\n1:\n``` read_trace.sh\n  while true;\n  do\n    # the \"trace\" file is closed after read\n    head -1 /sys/kernel/tracing/trace \u003e /dev/null\n  done\n```\n``` repro.sh\n  sysctl -w kernel.panic_on_warn=1\n  # function tracer will writing enough data into ring_buffer\n  echo function \u003e /sys/kernel/tracing/current_tracer\n  ./read_trace.sh \u0026\n  ./read_trace.sh \u0026\n  ./read_trace.sh \u0026\n  ./read_trace.sh \u0026\n  ./read_trace.sh \u0026\n  ./read_trace.sh \u0026\n  ./read_trace.sh \u0026\n  ./read_trace.sh \u0026\n```\n\n2:\n------------[ cut here ]------------\nWARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653\nrb_move_tail+0x450/0x470\nModules linked in:\nCPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G        W          6.2.0-rc6+\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\nrel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014\nRIP: 0010:rb_move_tail+0x450/0x470\nCode: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24\n83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 \u003c0f\u003e 0b 83\nf8 02 0f 84 ce fb ff ff e9 db\nRSP: 0018:ffffb5564089bd00 EFLAGS: 00000203\nRAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18\nRDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400\nRBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2\nR10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000\nR13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108\nFS:  0000000000000000(0000) GS:ffff9db3bdcc0000(0000)\nknlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0\nCall Trace:\n \u003cTASK\u003e\n ring_buffer_lock_reserve+0x136/0x360\n ? __do_softirq+0x287/0x2df\n ? __pfx_rcu_softirq_qs+0x10/0x10\n trace_function+0x21/0x110\n ? __pfx_rcu_softirq_qs+0x10/0x10\n ? __do_softirq+0x287/0x2df\n function_trace_call+0xf6/0x120\n 0xffffffffc038f097\n ? rcu_softirq_qs+0x5/0x140\n rcu_softirq_qs+0x5/0x140\n __do_softirq+0x287/0x2df\n run_ksoftirqd+0x2a/0x30\n smpboot_thread_fn+0x188/0x220\n ? __pfx_smpboot_thread_fn+0x10/0x10\n kthread+0xe7/0x110\n ? __pfx_kthread+0x10/0x10\n ret_from_fork+0x2c/0x50\n \u003c/TASK\u003e\n---[ end trace 0000000000000000 ]---\n\n[ crash report and test reproducer credit goes to Zheng Yejian]"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-22T13:23:45.155Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6e02a43acd0691791df79ce538f2dd497a6c9b76"
        },
        {
          "url": "https://git.kernel.org/stable/c/d41db100bc386b9433a3fc87026f5e8b453653e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/9674390ac540ed06768e3fbc2dba553929fbd736"
        },
        {
          "url": "https://git.kernel.org/stable/c/09b1bf25f7f7a8f2bf8cd4278bba9c3172db8013"
        },
        {
          "url": "https://git.kernel.org/stable/c/8843e06f67b14f71c044bf6267b2387784c7e198"
        }
      ],
      "title": "ring-buffer: Handle race between rb_move_tail and rb_check_pages",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53709",
    "datePublished": "2025-10-22T13:23:45.155Z",
    "dateReserved": "2025-10-22T13:21:37.346Z",
    "dateUpdated": "2025-10-22T13:23:45.155Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53709\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-10-22T14:15:45.510\",\"lastModified\":\"2025-10-22T21:12:48.953\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nring-buffer: Handle race between rb_move_tail and rb_check_pages\\n\\nIt seems a data race between ring_buffer writing and integrity check.\\nThat is, RB_FLAG of head_page is been updating, while at same time\\nRB_FLAG was cleared when doing integrity check rb_check_pages():\\n\\n  rb_check_pages()            rb_handle_head_page():\\n  --------                    --------\\n  rb_head_page_deactivate()\\n                              rb_head_page_set_normal()\\n  rb_head_page_activate()\\n\\nWe do intergrity test of the list to check if the list is corrupted and\\nit is still worth doing it. So, let\u0027s refactor rb_check_pages() such that\\nwe no longer clear and set flag during the list sanity checking.\\n\\n[1] and [2] are the test to reproduce and the crash report respectively.\\n\\n1:\\n``` read_trace.sh\\n  while true;\\n  do\\n    # the \\\"trace\\\" file is closed after read\\n    head -1 /sys/kernel/tracing/trace \u003e /dev/null\\n  done\\n```\\n``` repro.sh\\n  sysctl -w kernel.panic_on_warn=1\\n  # function tracer will writing enough data into ring_buffer\\n  echo function \u003e /sys/kernel/tracing/current_tracer\\n  ./read_trace.sh \u0026\\n  ./read_trace.sh \u0026\\n  ./read_trace.sh \u0026\\n  ./read_trace.sh \u0026\\n  ./read_trace.sh \u0026\\n  ./read_trace.sh \u0026\\n  ./read_trace.sh \u0026\\n  ./read_trace.sh \u0026\\n```\\n\\n2:\\n------------[ cut here ]------------\\nWARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653\\nrb_move_tail+0x450/0x470\\nModules linked in:\\nCPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G        W          6.2.0-rc6+\\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\\nrel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014\\nRIP: 0010:rb_move_tail+0x450/0x470\\nCode: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24\\n83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 \u003c0f\u003e 0b 83\\nf8 02 0f 84 ce fb ff ff e9 db\\nRSP: 0018:ffffb5564089bd00 EFLAGS: 00000203\\nRAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18\\nRDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400\\nRBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2\\nR10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000\\nR13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108\\nFS:  0000000000000000(0000) GS:ffff9db3bdcc0000(0000)\\nknlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0\\nCall Trace:\\n \u003cTASK\u003e\\n ring_buffer_lock_reserve+0x136/0x360\\n ? __do_softirq+0x287/0x2df\\n ? __pfx_rcu_softirq_qs+0x10/0x10\\n trace_function+0x21/0x110\\n ? __pfx_rcu_softirq_qs+0x10/0x10\\n ? __do_softirq+0x287/0x2df\\n function_trace_call+0xf6/0x120\\n 0xffffffffc038f097\\n ? rcu_softirq_qs+0x5/0x140\\n rcu_softirq_qs+0x5/0x140\\n __do_softirq+0x287/0x2df\\n run_ksoftirqd+0x2a/0x30\\n smpboot_thread_fn+0x188/0x220\\n ? __pfx_smpboot_thread_fn+0x10/0x10\\n kthread+0xe7/0x110\\n ? __pfx_kthread+0x10/0x10\\n ret_from_fork+0x2c/0x50\\n \u003c/TASK\u003e\\n---[ end trace 0000000000000000 ]---\\n\\n[ crash report and test reproducer credit goes to Zheng Yejian]\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/09b1bf25f7f7a8f2bf8cd4278bba9c3172db8013\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6e02a43acd0691791df79ce538f2dd497a6c9b76\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8843e06f67b14f71c044bf6267b2387784c7e198\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9674390ac540ed06768e3fbc2dba553929fbd736\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d41db100bc386b9433a3fc87026f5e8b453653e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.