CVE-2023-53375: In the Linux kernel, the following vulnerability has been resolved: tracing: Free error logs of tracing instances When a tracing instance is removed, the error…

PriorityP418medium5.5CVSS 3.1

AVLACLPRLUINSUCNINAH

EPSS

0.15%

4.3th percentile

In the Linux kernel, the following vulnerability has been resolved:

tracing: Free error logs of tracing instances

When a tracing instance is removed, the error messages that hold errors
that occurred in the instance needs to be freed. The following reports a
memory leak:

# cd /sys/kernel/tracing
# mkdir instances/foo
# echo 'hist:keys=x' > instances/foo/events/sched/sched_switch/trigger
# cat instances/foo/error_log
[ 117.404795] hist:sched:sched_switch: error: Couldn't find field
Command: hist:keys=x
^
# rmdir instances/foo

Then check for memory leaks:

# echo scan > /sys/kernel/debug/kmemleak
# cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff88810d8ec700 (size 192):
comm "bash", pid 869, jiffies 4294950577 (age 215.752s)
hex dump (first 32 bytes):
60 dd 68 61 81 88 ff ff 60 dd 68 61 81 88 ff ff `.ha....`.ha....
a0 30 8c 83 ff ff ff ff 26 00 0a 00 00 00 00 00 .0......&.......
backtrace:
[] kmalloc_trace+0x2a/0xa0
[] tracing_log_err+0x277/0x2e0
[] parse_atom+0x966/0xb40
[] parse_expr+0x5f3/0xdb0
[] event_hist_trigger_parse+0x27f8/0x3560
[] trigger_process_regex+0x135/0x1a0
[] event_trigger_write+0x87/0xf0
[] vfs_write+0x162/0x670
[] ksys_write+0xca/0x170
[] do_syscall_64+0x3e/0xc0
[] entry_SYSCALL_64_after_hwframe+0x72/0xdc
unreferenced object 0xffff888170c35a00 (size 32):
comm "bash", pid 869, jiffies 4294950577 (age 215.752s)
hex dump (first 32 bytes):
0a 20 20 43 6f 6d 6d 61 6e 64 3a 20 68 69 73 74 . Command: hist
3a 6b 65 79 73 3d 78 0a 00 00 00 00 00 00 00 00 :keys=x.........
backtrace:
[] __kmalloc+0x4d/0x160
[] tracing_log_err+0x29b/0x2e0
[] parse_atom+0x966/0xb40
[] parse_expr+0x5f3/0xdb0
[] event_hist_trigger_parse+0x27f8/0x3560
[] trigger_process_regex+0x135/0x1a0
[] event_trigger_write+0x87/0xf0
[] vfs_write+0x162/0x670
[] ksys_write+0xca/0x170
[] do_syscall_64+0x3e/0xc0
[] entry_SYSCALL_64_after_hwframe+0x72/0xdc

The problem is that the error log needs to be freed when the instance is
removed.

Affected

18 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.25-1 (bookworm)	linux 6.1.25-1 (bookworm)
linux	linux	—	—
linux	linux	>= 2f754e771b1a6feba670782e82c45555984ac43b < 987f599fc556a4e64c405d8dde32c70311e8c278	987f599fc556a4e64c405d8dde32c70311e8c278
linux	linux	>= 2f754e771b1a6feba670782e82c45555984ac43b < 6e36373aa5ffa8e00fe7c71b3209f6f17081e552	6e36373aa5ffa8e00fe7c71b3209f6f17081e552
linux	linux	>= 2f754e771b1a6feba670782e82c45555984ac43b < 33d5d4e67a0e13c3ca6257fa67bf6503bc000878	33d5d4e67a0e13c3ca6257fa67bf6503bc000878
linux	linux	>= 2f754e771b1a6feba670782e82c45555984ac43b < c0cf0f55be043ef67c38f492aa37ed1986d2f6b6	c0cf0f55be043ef67c38f492aa37ed1986d2f6b6
linux	linux	>= 2f754e771b1a6feba670782e82c45555984ac43b < 46771c34d6721abfd9e7903eaed2201051eebec6	46771c34d6721abfd9e7903eaed2201051eebec6
linux	linux	>= 2f754e771b1a6feba670782e82c45555984ac43b < 3357c6e429643231e60447b52ffbb7ac895aca22	3357c6e429643231e60447b52ffbb7ac895aca22
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.178-1	5.10.178-1
linux	linux_kernel	>= 0 < 6.1.25-1	6.1.25-1
linux	linux_kernel	>= 0 < 6.1.25-1	6.1.25-1
linux	linux_kernel	>= 0 < 6.1.25-1	6.1.25-1
linux	linux_kernel	>= 5.11 < 5.15.107	5.15.107
linux	linux_kernel	>= 5.16 < 6.1.24	6.1.24
linux	linux_kernel	>= 5.2 < 5.4.241	5.4.241
linux	linux_kernel	>= 5.5 < 5.10.178	5.10.178
linux	linux_kernel	>= 6.2 < 6.2.11	6.2.11

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv5.5MEDIUM

vendor_debian5.5MEDIUM

vendor_redhat5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.