fkie_cve-2023-53478
Vulnerability from fkie_nvd
Published
2025-10-01 12:15
Modified
2025-10-02 19:12
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing/synthetic: Fix races on freeing last_cmd Currently, the "last_cmd" variable can be accessed by multiple processes asynchronously when multiple users manipulate synthetic_events node at the same time, it could lead to use-after-free or double-free. This patch add "lastcmd_mutex" to prevent "last_cmd" from being accessed asynchronously. ================================================================ It's easy to reproduce in the KASAN environment by running the two scripts below in different shells. script 1: while : do echo -n -e '\x88' > /sys/kernel/tracing/synthetic_events done script 2: while : do echo -n -e '\xb0' > /sys/kernel/tracing/synthetic_events done ================================================================ double-free scenario: process A process B ------------------- --------------- 1.kstrdup last_cmd 2.free last_cmd 3.free last_cmd(double-free) ================================================================ use-after-free scenario: process A process B ------------------- --------------- 1.kstrdup last_cmd 2.free last_cmd 3.tracing_log_err(use-after-free) ================================================================ Appendix 1. KASAN report double-free: BUG: KASAN: double-free in kfree+0xdc/0x1d4 Free of addr ***** by task sh/4879 Call trace: ... kfree+0xdc/0x1d4 create_or_delete_synth_event+0x60/0x1e8 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... Allocated by task 4879: ... kstrdup+0x5c/0x98 create_or_delete_synth_event+0x6c/0x1e8 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... Freed by task 5464: ... kfree+0xdc/0x1d4 create_or_delete_synth_event+0x60/0x1e8 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... ================================================================ Appendix 2. KASAN report use-after-free: BUG: KASAN: use-after-free in strlen+0x5c/0x7c Read of size 1 at addr ***** by task sh/5483 sh: CPU: 7 PID: 5483 Comm: sh ... __asan_report_load1_noabort+0x34/0x44 strlen+0x5c/0x7c tracing_log_err+0x60/0x444 create_or_delete_synth_event+0xc4/0x204 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... Allocated by task 5483: ... kstrdup+0x5c/0x98 create_or_delete_synth_event+0x80/0x204 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... Freed by task 5480: ... kfree+0xdc/0x1d4 create_or_delete_synth_event+0x74/0x204 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ...
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4ccf11c4e8a8e051499d53a12f502196c97a758e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8826d9e7bd51e7656f78baa4472e8e2f5e7069f0
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9fe183f659a2704255e5d84f6ae308c234a113ec
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/synthetic: Fix races on freeing last_cmd\n\nCurrently, the \"last_cmd\" variable can be accessed by multiple processes\nasynchronously when multiple users manipulate synthetic_events node\nat the same time, it could lead to use-after-free or double-free.\n\nThis patch add \"lastcmd_mutex\" to prevent \"last_cmd\" from being accessed\nasynchronously.\n\n================================================================\n\nIt\u0027s easy to reproduce in the KASAN environment by running the two\nscripts below in different shells.\n\nscript 1:\n        while :\n        do\n                echo -n -e \u0027\\x88\u0027 \u003e /sys/kernel/tracing/synthetic_events\n        done\n\nscript 2:\n        while :\n        do\n                echo -n -e \u0027\\xb0\u0027 \u003e /sys/kernel/tracing/synthetic_events\n        done\n\n================================================================\ndouble-free scenario:\n\n    process A                       process B\n-------------------               ---------------\n1.kstrdup last_cmd\n                                  2.free last_cmd\n3.free last_cmd(double-free)\n\n================================================================\nuse-after-free scenario:\n\n    process A                       process B\n-------------------               ---------------\n1.kstrdup last_cmd\n                                  2.free last_cmd\n3.tracing_log_err(use-after-free)\n\n================================================================\n\nAppendix 1. KASAN report double-free:\n\nBUG: KASAN: double-free in kfree+0xdc/0x1d4\nFree of addr ***** by task sh/4879\nCall trace:\n        ...\n        kfree+0xdc/0x1d4\n        create_or_delete_synth_event+0x60/0x1e8\n        trace_parse_run_command+0x2bc/0x4b8\n        synth_events_write+0x20/0x30\n        vfs_write+0x200/0x830\n        ...\n\nAllocated by task 4879:\n        ...\n        kstrdup+0x5c/0x98\n        create_or_delete_synth_event+0x6c/0x1e8\n        trace_parse_run_command+0x2bc/0x4b8\n        synth_events_write+0x20/0x30\n        vfs_write+0x200/0x830\n        ...\n\nFreed by task 5464:\n        ...\n        kfree+0xdc/0x1d4\n        create_or_delete_synth_event+0x60/0x1e8\n        trace_parse_run_command+0x2bc/0x4b8\n        synth_events_write+0x20/0x30\n        vfs_write+0x200/0x830\n        ...\n\n================================================================\nAppendix 2. KASAN report use-after-free:\n\nBUG: KASAN: use-after-free in strlen+0x5c/0x7c\nRead of size 1 at addr ***** by task sh/5483\nsh: CPU: 7 PID: 5483 Comm: sh\n        ...\n        __asan_report_load1_noabort+0x34/0x44\n        strlen+0x5c/0x7c\n        tracing_log_err+0x60/0x444\n        create_or_delete_synth_event+0xc4/0x204\n        trace_parse_run_command+0x2bc/0x4b8\n        synth_events_write+0x20/0x30\n        vfs_write+0x200/0x830\n        ...\n\nAllocated by task 5483:\n        ...\n        kstrdup+0x5c/0x98\n        create_or_delete_synth_event+0x80/0x204\n        trace_parse_run_command+0x2bc/0x4b8\n        synth_events_write+0x20/0x30\n        vfs_write+0x200/0x830\n        ...\n\nFreed by task 5480:\n        ...\n        kfree+0xdc/0x1d4\n        create_or_delete_synth_event+0x74/0x204\n        trace_parse_run_command+0x2bc/0x4b8\n        synth_events_write+0x20/0x30\n        vfs_write+0x200/0x830\n        ..."
    }
  ],
  "id": "CVE-2023-53478",
  "lastModified": "2025-10-02T19:12:17.160",
  "metrics": {},
  "published": "2025-10-01T12:15:50.270",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4ccf11c4e8a8e051499d53a12f502196c97a758e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8826d9e7bd51e7656f78baa4472e8e2f5e7069f0"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9fe183f659a2704255e5d84f6ae308c234a113ec"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Awaiting Analysis"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.