CVE-2023-52879
published 2024-05-21CVE-2023-52879: In the Linux kernel, the following vulnerability has been resolved: tracing: Have trace_event_file have ref counters The following can crash the kernel: # cd…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.23%
13.4th percentile
In the Linux kernel, the following vulnerability has been resolved: tracing: Have trace_event_file have ref counters The following can crash the kernel: # cd /sys/kernel/tracing # echo 'p:sched schedule' > kprobe_events # exec 5>>events/kprobes/sched/enable # > kprobe_events # exec 5>&- The above commands: 1. Change directory to the tracefs directory 2. Create a kprobe event (doesn't matter what one) 3. Open bash file descriptor 5 on the enable file of the kprobe event 4. Delete the kprobe event (removes the files too) 5. Close the bash file descriptor 5 The above causes a crash! BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 877 Comm: bash Not tainted 6.5.0-rc4-test-00008-g2c6b6b1029d4-dirty #186 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:tracing_release_file_tr+0xc/0x50 What happens here is that the kprobe event creates a trace_event_file "file" descriptor that represents the file in tracefs to the event. It maintains state of the event (is it enabled for the given instance?). Opening the "enable" file gets a reference to the event "file" descriptor via the open file descriptor. When the kprobe event is deleted, the file is also deleted from the tracefs system which also frees the event "file" descriptor. But as the tracefs file is still opened by user space, it will not be totally removed until the final dput() is called on it. But this is not true with the event "file" descriptor that is already freed. If the user does a write to or simply closes the file descriptor it will reference the event "file" descriptor that was just freed, causing a use-after-free bug. To solve this, add a ref count to the event "file" descriptor as well as a new flag called "FREED". The "file" will not be freed until the last reference is released. But the FREE f
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.64-1 (bookworm) | linux 6.1.64-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 407bf1c140f0757706c0b28604bcc90837d45ce2 < a98172e36e5f1b3d29ad71fade2d611cfcc2fe6f | a98172e36e5f1b3d29ad71fade2d611cfcc2fe6f |
| linux | linux | >= 5.10.198 < 5.10.202 | 5.10.202 |
| linux | linux | >= 5.15.134 < 5.15.140 | 5.15.140 |
| linux | linux | >= 5.4.258 < 5.4.262 | 5.4.262 |
| linux | linux | >= 6.1.55 < 6.1.64 | 6.1.64 |
| linux | linux | >= 6.5.5 < 6.5.13 | 6.5.13 |
| linux | linux | >= 9beec04370132a7a6cd1aa9897f6fffc6262ff28 < 2c9de867ca285c397cd71af703763fe416265706 | 2c9de867ca285c397cd71af703763fe416265706 |
| linux | linux | >= a46bf337a20f9edd3c8041b025639842280d0575 < 2fa74d29fc1899c237d51bf9a6e132ea5c488976 | 2fa74d29fc1899c237d51bf9a6e132ea5c488976 |
| linux | linux | >= e6807c873d8791ae5a5186ad05ec66cab926539a < 961c4511c7578d6b8f39118be919016ec3db1c1e | 961c4511c7578d6b8f39118be919016ec3db1c1e |
| linux | linux | >= f5ca233e2e66dc1c249bf07eefa37e34a6c9346a < 9034c87d61be8cff989017740a91701ac8195a1d | 9034c87d61be8cff989017740a91701ac8195a1d |
| linux | linux | >= f5ca233e2e66dc1c249bf07eefa37e34a6c9346a < bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4 | bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4 |
| linux | linux | >= fa6d449e4d024d8c17f4288e0567d28ace69415c < cbc7c29dff0fa18162f2a3889d82eeefd67305e0 | cbc7c29dff0fa18162f2a3889d82eeefd67305e0 |
| linux | linux_kernel | >= 0 < 5.10.205-1 | 5.10.205-1 |
| linux | linux_kernel | >= 0 < 6.1.64-1 | 6.1.64-1 |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 0 < 6.6.8-1 | 6.6.8-1 |
| linux | linux_kernel | >= 5.10.198 < 5.10.202 | 5.10.202 |
| linux | linux_kernel | >= 5.15.134 < 5.15.140 | 5.15.140 |
| linux | linux_kernel | >= 5.4.258 < 5.4.262 | 5.4.262 |
| linux | linux_kernel | >= 6.1.55 < 6.1.64 | 6.1.64 |
| linux | linux_kernel | >= 6.5.5 < 6.5.13 | 6.5.13 |
| linux | linux_kernel | >= 6.6 < 6.6.1 | 6.6.1 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SINEC OS
cisa_ics·2025-08-14
Siemens SINEC OS
ICS Advisory
##
Siemens SINEC OS
Release DateAugust 14, 2025
Alert CodeICSA-25-226-15
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3.1 9.1
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: RUGGEDCOM, SCALANCE
- Vulnerabilities: NULL Pointer Dereference, Use After Free, Unchecked Input for Loop Condition, Out-of-bounds Write, Ou
Red Hat
kernel: tracing: Have trace_event_file have ref counters
vendor_redhat·2024-05-21·CVSS 5.5
CVE-2023-52879 [MEDIUM] CWE-395 kernel: tracing: Have trace_event_file have ref counters
kernel: tracing: Have trace_event_file have ref counters
In the Linux kernel, the following vulnerability has been resolved:
tracing: Have trace_event_file have ref counters
The following can crash the kernel:
# cd /sys/kernel/tracing
# echo 'p:sched schedule' > kprobe_events
# exec 5>>events/kprobes/sched/enable
# > kprobe_events
# exec 5>&-
The above commands:
1. Change directory to the tracefs directory
2. Create a kprobe event (doesn't matter what one)
3. Open bash file descriptor 5 on the enable file of the kprobe event
4. Delete the kprobe event (removes the files too)
5. Close the bash file descriptor 5
The above causes a crash!
BUG: kernel NULL pointer dereference, address: 0000000000000028
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0
Debian
CVE-2023-52879: linux - In the Linux kernel, the following vulnerability has been resolved: tracing: Ha...
vendor_debian·2023·CVSS 5.5
CVE-2023-52879 [MEDIUM] CVE-2023-52879: linux - In the Linux kernel, the following vulnerability has been resolved: tracing: Ha...
In the Linux kernel, the following vulnerability has been resolved: tracing: Have trace_event_file have ref counters The following can crash the kernel: # cd /sys/kernel/tracing # echo 'p:sched schedule' > kprobe_events # exec 5>>events/kprobes/sched/enable # > kprobe_events # exec 5>&- The above commands: 1. Change directory to the tracefs directory 2. Create a kprobe event (doesn't matter what one) 3. Open bash file descriptor 5 on the enable file of the kprobe event 4. Delete the kprobe event (removes the files too) 5. Close the bash file descriptor 5 The above causes a crash! BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 877 Com
OSV
CVE-2023-52879: In the Linux kernel, the following vulnerability has been resolved: tracing: Have trace_event_file have ref counters The following can crash the kerne
osv·2024-05-21·CVSS 5.5
CVE-2023-52879 [MEDIUM] CVE-2023-52879: In the Linux kernel, the following vulnerability has been resolved: tracing: Have trace_event_file have ref counters The following can crash the kerne
In the Linux kernel, the following vulnerability has been resolved: tracing: Have trace_event_file have ref counters The following can crash the kernel: # cd /sys/kernel/tracing # echo 'p:sched schedule' > kprobe_events # exec 5>>events/kprobes/sched/enable # > kprobe_events # exec 5>&- The above commands: 1. Change directory to the tracefs directory 2. Create a kprobe event (doesn't matter what one) 3. Open bash file descriptor 5 on the enable file of the kprobe event 4. Delete the kprobe event (removes the files too) 5. Close the bash file descriptor 5 The above causes a crash! BUG: kernel NULL pointer dereference, address: 0000000000000028 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 6 PID: 877 Com
GHSA
GHSA-8j5h-5p5c-hg7m: In the Linux kernel, the following vulnerability has been resolved:
tracing: Have trace_event_file have ref counters
The following can crash the ker
ghsa_unreviewed·2024-05-21
CVE-2023-52879 [MEDIUM] CWE-476 GHSA-8j5h-5p5c-hg7m: In the Linux kernel, the following vulnerability has been resolved:
tracing: Have trace_event_file have ref counters
The following can crash the ker
In the Linux kernel, the following vulnerability has been resolved:
tracing: Have trace_event_file have ref counters
The following can crash the kernel:
# cd /sys/kernel/tracing
# echo 'p:sched schedule' > kprobe_events
# exec 5>>events/kprobes/sched/enable
# > kprobe_events
# exec 5>&-
The above commands:
1. Change directory to the tracefs directory
2. Create a kprobe event (doesn't matter what one)
3. Open bash file descriptor 5 on the enable file of the kprobe event
4. Delete the kprobe event (removes the files too)
5. Close the bash file descriptor 5
The above causes a crash!
BUG: kernel NULL pointer dereference, address: 0000000000000028
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 6 PID:
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/2c9de867ca285c397cd71af703763fe416265706https://git.kernel.org/stable/c/2fa74d29fc1899c237d51bf9a6e132ea5c488976https://git.kernel.org/stable/c/9034c87d61be8cff989017740a91701ac8195a1dhttps://git.kernel.org/stable/c/961c4511c7578d6b8f39118be919016ec3db1c1ehttps://git.kernel.org/stable/c/a98172e36e5f1b3d29ad71fade2d611cfcc2fe6fhttps://git.kernel.org/stable/c/bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4https://git.kernel.org/stable/c/cbc7c29dff0fa18162f2a3889d82eeefd67305e0https://git.kernel.org/stable/c/2c9de867ca285c397cd71af703763fe416265706https://git.kernel.org/stable/c/2fa74d29fc1899c237d51bf9a6e132ea5c488976https://git.kernel.org/stable/c/9034c87d61be8cff989017740a91701ac8195a1dhttps://git.kernel.org/stable/c/961c4511c7578d6b8f39118be919016ec3db1c1ehttps://git.kernel.org/stable/c/a98172e36e5f1b3d29ad71fade2d611cfcc2fe6fhttps://git.kernel.org/stable/c/bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4https://git.kernel.org/stable/c/cbc7c29dff0fa18162f2a3889d82eeefd67305e0
2024-05-21
Published