CVE-2023-52835
published 2024-05-21CVE-2023-52835: In the Linux kernel, the following vulnerability has been resolved: perf/core: Bail out early if the request AUX area is out of bound When perf-record with a…
PriorityP338high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.25%
16.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Bail out early if the request AUX area is out of bound
When perf-record with a large AUX area, e.g 4GB, it fails with:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
and it reveals a WARNING with __alloc_pages():
------------[ cut here ]------------
WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248
Call trace:
__alloc_pages+0x1ec/0x248
__kmalloc_large_node+0xc0/0x1f8
__kmalloc_node+0x134/0x1e8
rb_alloc_aux+0xe0/0x298
perf_mmap+0x440/0x660
mmap_region+0x308/0x8a8
do_mmap+0x3c0/0x528
vm_mmap_pgoff+0xf4/0x1b8
ksys_mmap_pgoff+0x18c/0x218
__arm64_sys_mmap+0x38/0x58
invoke_syscall+0x50/0x128
el0_svc_common.constprop.0+0x58/0x188
do_el0_svc+0x34/0x50
el0_svc+0x34/0x108
el0t_64_sync_handler+0xb8/0xc0
el0t_64_sync+0x1a4/0x1a8
'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to
maintains AUX trace pages. The allocated page for this array is physically
contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the
size of pointer array crosses the limitation set by MAX_ORDER, it reveals a
WARNING.
So bail out early with -ENOMEM if the request AUX area is out of bound,
e.g.:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.64-1 (bookworm) | linux 6.1.64-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 45bfb2e50471abbbfd83d40d28c986078b0d24ff < 8c504f615d7ed60ae035c51d0c789137ced6797f | 8c504f615d7ed60ae035c51d0c789137ced6797f |
| linux | linux | >= 45bfb2e50471abbbfd83d40d28c986078b0d24ff < 788c0b3442ead737008934947730a6d1ff703734 | 788c0b3442ead737008934947730a6d1ff703734 |
| linux | linux | >= 45bfb2e50471abbbfd83d40d28c986078b0d24ff < 1a2a4202c60fcdffbf04f259002ce9bff39edece | 1a2a4202c60fcdffbf04f259002ce9bff39edece |
| linux | linux | >= 45bfb2e50471abbbfd83d40d28c986078b0d24ff < fd0df3f8719201dbe61a4d39083d5aecd705399a | fd0df3f8719201dbe61a4d39083d5aecd705399a |
| linux | linux | >= 45bfb2e50471abbbfd83d40d28c986078b0d24ff < 9ce4e87a8efd37c85766ec08b15e885cab08553a | 9ce4e87a8efd37c85766ec08b15e885cab08553a |
| linux | linux | >= 45bfb2e50471abbbfd83d40d28c986078b0d24ff < 2424410f94a94d91230ced094062d859714c984a | 2424410f94a94d91230ced094062d859714c984a |
| linux | linux | >= 45bfb2e50471abbbfd83d40d28c986078b0d24ff < 2e905e608e38cf7f8dcddcf8a6036e91a78444cb | 2e905e608e38cf7f8dcddcf8a6036e91a78444cb |
| linux | linux | >= 45bfb2e50471abbbfd83d40d28c986078b0d24ff < 54aee5f15b83437f23b2b2469bcf21bdd9823916 | 54aee5f15b83437f23b2b2469bcf21bdd9823916 |
| linux | linux_kernel | < 4.19.300 | 4.19.300 |
| linux | linux_kernel | >= 0 < 5.10.205-1 | 5.10.205-1 |
| linux | linux_kernel | >= 0 < 6.1.64-1 | 6.1.64-1 |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 4.20 < 5.4.262 | 5.4.262 |
| linux | linux_kernel | >= 5.11 < 5.15.140 | 5.15.140 |
| linux | linux_kernel | >= 5.16 < 6.1.64 | 6.1.64 |
| linux | linux_kernel | >= 5.5 < 5.10.202 | 5.10.202 |
| linux | linux_kernel | >= 6.2 < 6.5.13 | 6.5.13 |
| linux | linux_kernel | >= 6.6 < 6.6.3 | 6.6.3 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEC OS
cisa_ics·2025-08-14
Siemens SINEC OS
ICS Advisory
##
Siemens SINEC OS
Release DateAugust 14, 2025
Alert CodeICSA-25-226-15
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3.1 9.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM, SCALANCE
- Vulnerabilities: NULL Pointer Dereference, Use After Free, Unchecked Input for Loop Condition, Out-of-bounds Write, Ou
Red Hat
kernel: perf/core: Bail out early if the request AUX area is out of bound
vendor_redhat·2024-05-21·CVSS 7.8
CVE-2023-52835 [HIGH] CWE-125 kernel: perf/core: Bail out early if the request AUX area is out of bound
kernel: perf/core: Bail out early if the request AUX area is out of bound
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Bail out early if the request AUX area is out of bound
When perf-record with a large AUX area, e.g 4GB, it fails with:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
and it reveals a WARNING with __alloc_pages():
------------[ cut here ]------------
WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248
Call trace:
__alloc_pages+0x1ec/0x248
__kmalloc_large_node+0xc0/0x1f8
__kmalloc_node+0x134/0x1e8
rb_alloc_aux+0xe0/0x298
perf_mmap+0x440/0x660
mmap_region+0x308/0x8a8
do_mmap+0x3c0/0x528
vm_mmap_pgoff+0xf4/0x1b8
ksys_mmap_pgoff+0x18c/0x218
__arm64_sys_mmap+0x38/0x58
Debian
CVE-2023-52835: linux - In the Linux kernel, the following vulnerability has been resolved: perf/core: ...
vendor_debian·2023·CVSS 7.8
CVE-2023-52835 [HIGH] CVE-2023-52835: linux - In the Linux kernel, the following vulnerability has been resolved: perf/core: ...
In the Linux kernel, the following vulnerability has been resolved: perf/core: Bail out early if the request AUX area is out of bound When perf-record with a large AUX area, e.g 4GB, it fails with: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory) and it reveals a WARNING with __alloc_pages(): ------------[ cut here ]------------ WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248 Call trace: __alloc_pages+0x1ec/0x248 __kmalloc_large_node+0xc0/0x1f8 __kmalloc_node+0x134/0x1e8 rb_alloc_aux+0xe0/0x298 perf_mmap+0x440/0x660 mmap_region+0x308/0x8a8 do_mmap+0x3c0/0x528 vm_mmap_pgoff+0xf4/0x1b8 ksys_mmap_pgoff+0x18c/0x218 __arm64_sys_mmap+0x38/0x58 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x58/0x188 do_el0_svc
GHSA
GHSA-p6xg-gj77-6vpg: In the Linux kernel, the following vulnerability has been resolved:
perf/core: Bail out early if the request AUX area is out of bound
When perf-reco
ghsa_unreviewed·2024-05-21
CVE-2023-52835 [HIGH] CWE-129 GHSA-p6xg-gj77-6vpg: In the Linux kernel, the following vulnerability has been resolved:
perf/core: Bail out early if the request AUX area is out of bound
When perf-reco
In the Linux kernel, the following vulnerability has been resolved:
perf/core: Bail out early if the request AUX area is out of bound
When perf-record with a large AUX area, e.g 4GB, it fails with:
#perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1
failed to mmap with 12 (Cannot allocate memory)
and it reveals a WARNING with __alloc_pages():
------------[ cut here ]------------
WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248
Call trace:
__alloc_pages+0x1ec/0x248
__kmalloc_large_node+0xc0/0x1f8
__kmalloc_node+0x134/0x1e8
rb_alloc_aux+0xe0/0x298
perf_mmap+0x440/0x660
mmap_region+0x308/0x8a8
do_mmap+0x3c0/0x528
vm_mmap_pgoff+0xf4/0x1b8
ksys_mmap_pgoff+0x18c/0x218
__arm64_sys_mmap+0x38/0x58
invoke_syscall+0x50/0x128
el0_svc_common.constprop.0+0x58/0x188
do_el
OSV
CVE-2023-52835: In the Linux kernel, the following vulnerability has been resolved: perf/core: Bail out early if the request AUX area is out of bound When perf-record
osv·2024-05-21·CVSS 7.8
CVE-2023-52835 [HIGH] CVE-2023-52835: In the Linux kernel, the following vulnerability has been resolved: perf/core: Bail out early if the request AUX area is out of bound When perf-record
In the Linux kernel, the following vulnerability has been resolved: perf/core: Bail out early if the request AUX area is out of bound When perf-record with a large AUX area, e.g 4GB, it fails with: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory) and it reveals a WARNING with __alloc_pages(): ------------[ cut here ]------------ WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248 Call trace: __alloc_pages+0x1ec/0x248 __kmalloc_large_node+0xc0/0x1f8 __kmalloc_node+0x134/0x1e8 rb_alloc_aux+0xe0/0x298 perf_mmap+0x440/0x660 mmap_region+0x308/0x8a8 do_mmap+0x3c0/0x528 vm_mmap_pgoff+0xf4/0x1b8 ksys_mmap_pgoff+0x18c/0x218 __arm64_sys_mmap+0x38/0x58 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x58/0x188 do_el0_svc
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1a2a4202c60fcdffbf04f259002ce9bff39edecehttps://git.kernel.org/stable/c/2424410f94a94d91230ced094062d859714c984ahttps://git.kernel.org/stable/c/2e905e608e38cf7f8dcddcf8a6036e91a78444cbhttps://git.kernel.org/stable/c/54aee5f15b83437f23b2b2469bcf21bdd9823916https://git.kernel.org/stable/c/788c0b3442ead737008934947730a6d1ff703734https://git.kernel.org/stable/c/8c504f615d7ed60ae035c51d0c789137ced6797fhttps://git.kernel.org/stable/c/9ce4e87a8efd37c85766ec08b15e885cab08553ahttps://git.kernel.org/stable/c/fd0df3f8719201dbe61a4d39083d5aecd705399ahttps://git.kernel.org/stable/c/1a2a4202c60fcdffbf04f259002ce9bff39edecehttps://git.kernel.org/stable/c/2424410f94a94d91230ced094062d859714c984ahttps://git.kernel.org/stable/c/2e905e608e38cf7f8dcddcf8a6036e91a78444cbhttps://git.kernel.org/stable/c/54aee5f15b83437f23b2b2469bcf21bdd9823916https://git.kernel.org/stable/c/788c0b3442ead737008934947730a6d1ff703734https://git.kernel.org/stable/c/8c504f615d7ed60ae035c51d0c789137ced6797fhttps://git.kernel.org/stable/c/9ce4e87a8efd37c85766ec08b15e885cab08553ahttps://git.kernel.org/stable/c/fd0df3f8719201dbe61a4d39083d5aecd705399a
2024-05-21
Published