CVE-2023-54139 (GCVE-0-2023-54139)

Vulnerability from cvelistv5 – Published: 2025-12-24 13:06 – Updated: 2026-08-05 09:17
VLAI
Title
tracing/user_events: Ensure write index cannot be negative
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Ensure write index cannot be negative The write index indicates which event the data is for and accesses a per-file array. The index is passed by user processes during write() calls as the first 4 bytes. Ensure that it cannot be negative by returning -EINVAL to prevent out of bounds accesses. Update ftrace self-test to ensure this occurs properly.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 7f5a08c79df35e68f1a43033450c5050f12bc155 , < 0489c2b2c3104b89f078dbcec8c744dfc157d3e9 (git)
Affected: 7f5a08c79df35e68f1a43033450c5050f12bc155 , < 4fe46b5adf18e3dc606e62c9e6a0413398a17572 (git)
Affected: 7f5a08c79df35e68f1a43033450c5050f12bc155 , < fa7f2f5d1739452280c22727c4384a52b72ab5de (git)
Affected: 7f5a08c79df35e68f1a43033450c5050f12bc155 , < cd98c93286a30cc4588dfd02453bec63c2f4acf4 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 6.1.28 , ≤ 6.1.* (semver)
Unaffected: 6.2.15 , ≤ 6.2.* (semver)
Unaffected: 6.3.2 , ≤ 6.3.* (semver)
Unaffected: 6.4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_user.c",
            "tools/testing/selftests/user_events/ftrace_test.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0489c2b2c3104b89f078dbcec8c744dfc157d3e9",
              "status": "affected",
              "version": "7f5a08c79df35e68f1a43033450c5050f12bc155",
              "versionType": "git"
            },
            {
              "lessThan": "4fe46b5adf18e3dc606e62c9e6a0413398a17572",
              "status": "affected",
              "version": "7f5a08c79df35e68f1a43033450c5050f12bc155",
              "versionType": "git"
            },
            {
              "lessThan": "fa7f2f5d1739452280c22727c4384a52b72ab5de",
              "status": "affected",
              "version": "7f5a08c79df35e68f1a43033450c5050f12bc155",
              "versionType": "git"
            },
            {
              "lessThan": "cd98c93286a30cc4588dfd02453bec63c2f4acf4",
              "status": "affected",
              "version": "7f5a08c79df35e68f1a43033450c5050f12bc155",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_user.c",
            "tools/testing/selftests/user_events/ftrace_test.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.28",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.15",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.28",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.15",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/user_events: Ensure write index cannot be negative\n\nThe write index indicates which event the data is for and accesses a\nper-file array. The index is passed by user processes during write()\ncalls as the first 4 bytes. Ensure that it cannot be negative by\nreturning -EINVAL to prevent out of bounds accesses.\n\nUpdate ftrace self-test to ensure this occurs properly."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached only through local file operations \u2014 `ioctl()`/`write()`/`writev()` on the tracefs file `/sys/kernel/tracing/user_events_data`. There is no network or remote-peer data path into `user_events_write_core()`.\nAC:L - Triggering is fully deterministic \u2014 the attacker registers an event, then writes a payload whose first 4 bytes are a negative integer, and the signed comparison `idx \u003c refs-\u003ecount` is bypassed every time. No race, timing window, or condition outside the attacker\u0027s control is involved, and the attacker can freely groom the slab to influence what the OOB read returns.\nPR:L - The registration ioctl and the write path contain no capability checks; the only gate is write access to the tracefs `user_events_data` file, which this feature exists specifically to grant to ordinary unprivileged applications (via tracefs `gid=` mounts or relaxed permissions in tracing-enabled deployments). An unprivileged local user with the intended tracing access can trigger it, so no administrative privilege is needed.\nUI:N - The attacker performs the entire sequence \u2014 open, `DIAG_IOCSREG`, then a `writev()` with a negative index \u2014 within their own process. No victim action, mount, or interaction of any kind is required.\nS:U - The out-of-bounds access and resulting type confusion occur entirely within the kernel\u0027s own memory and security authority. There is no crossing of a VM, IOMMU, or sandbox boundary \u2014 this is a standard local kernel compromise.\nC:H - A negative index yields a pointer-sized out-of-bounds read anywhere within roughly 16 GB below the `user_event_refs` allocation, and the resulting bogus `struct user_event *` is dereferenced to read `min_size`, `tracepoint`, and `call` fields, whose contents are then emitted into trace/perf buffers readable by the attacker. This constitutes an effectively arbitrary kernel-memory read primitive.\nI:H - The OOB-read value is used as a `struct user_event *` and reaches `probe_func = probe_func_ptr-\u003efunc; probe_func(user, ...)`, an indirect call through an attacker-influenced pointer chain. Combined with heap grooming of the small `kmalloc` slab, this gives type confusion escalating to control-flow hijack and arbitrary kernel writes.\nA:H - Even without any exploitation effort, indexing arbitrarily far below the allocation and dereferencing the resulting garbage pointer reliably produces a kernel oops or panic. The fault is trivially and repeatedly reproducible by an unprivileged process, making it a dependable local denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:34.267Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0489c2b2c3104b89f078dbcec8c744dfc157d3e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fe46b5adf18e3dc606e62c9e6a0413398a17572"
        },
        {
          "url": "https://git.kernel.org/stable/c/fa7f2f5d1739452280c22727c4384a52b72ab5de"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd98c93286a30cc4588dfd02453bec63c2f4acf4"
        }
      ],
      "title": "tracing/user_events: Ensure write index cannot be negative",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54139",
    "datePublished": "2025-12-24T13:06:54.094Z",
    "dateReserved": "2025-12-24T13:02:52.522Z",
    "dateUpdated": "2026-08-05T09:17:34.267Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-54139",
      "date": "2026-09-27",
      "epss": "0.00153",
      "percentile": "0.03732"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "kernel/trace/trace_events_user.c",
                  "tools/testing/selftests/user_events/ftrace_test.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0489c2b2c3104b89f078dbcec8c744dfc157d3e9",
                    "status": "affected",
                    "version": "7f5a08c79df35e68f1a43033450c5050f12bc155",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4fe46b5adf18e3dc606e62c9e6a0413398a17572",
                    "status": "affected",
                    "version": "7f5a08c79df35e68f1a43033450c5050f12bc155",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fa7f2f5d1739452280c22727c4384a52b72ab5de",
                    "status": "affected",
                    "version": "7f5a08c79df35e68f1a43033450c5050f12bc155",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cd98c93286a30cc4588dfd02453bec63c2f4acf4",
                    "status": "affected",
                    "version": "7f5a08c79df35e68f1a43033450c5050f12bc155",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "kernel/trace/trace_events_user.c",
                  "tools/testing/selftests/user_events/ftrace_test.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.18"
                  },
                  {
                    "lessThan": "5.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.28",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.2.*",
                    "status": "unaffected",
                    "version": "6.2.15",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.3.*",
                    "status": "unaffected",
                    "version": "6.3.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/user_events: Ensure write index cannot be negative\n\nThe write index indicates which event the data is for and accesses a\nper-file array. The index is passed by user processes during write()\ncalls as the first 4 bytes. Ensure that it cannot be negative by\nreturning -EINVAL to prevent out of bounds accesses.\n\nUpdate ftrace self-test to ensure this occurs properly."
          }
        ],
        "id": "CVE-2023-54139",
        "lastModified": "2026-08-04T10:19:31.110",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-24T13:16:15.900",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0489c2b2c3104b89f078dbcec8c744dfc157d3e9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4fe46b5adf18e3dc606e62c9e6a0413398a17572"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cd98c93286a30cc4588dfd02453bec63c2f4acf4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fa7f2f5d1739452280c22727c4384a52b72ab5de"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-20T12:43:34+00:00",
      "cve": "CVE-2023-54139",
      "id": "CVE-2023-54139",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Privilege escalation via out-of-bounds write in tracing/user_events",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-54139.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:29:10Z",
      "cve": "CVE-2023-54139",
      "id": "CVE-2023-54139",
      "initial_release_date": "2025-12-25T00:54:43Z",
      "product_status:known_not_affected": "560",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-54139",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-54139.json",
      "version": "11"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.