CVE-2023-53478: tracing/synthetic: Fix races on freeing last_cmd
In the Linux kernel, the following vulnerability has been resolved:
tracing/synthetic: Fix races on freeing lastcmd
Currently, the "lastcmd" variable can be accessed by multiple processes asynchronously when multiple users manipulate syntheticevents node at the same time, it could lead to use-after-free or double-free.
This patch add "lastcmdmutex" to prevent "lastcmd" from being accessed asynchronously.
================================================================
It's easy to reproduce in the KASAN environment by running the two scripts below in different shells.
script 1: while : do echo -n -e '\x88' > /sys/kernel/tracing/syntheticevents done
script 2: while : do echo -n -e '\xb0' > /sys/kernel/tracing/syntheticevents done
================================================================ double-free scenario:
process A process B ------------------- --------------- 1.kstrdup lastcmd 2.free lastcmd 3.free lastcmd(double-free)
================================================================ use-after-free scenario:
process A process B ------------------- --------------- 1.kstrdup lastcmd 2.free lastcmd 3.tracinglogerr(use-after-free)
================================================================
Appendix 1. KASAN report double-free:
BUG: KASAN: double-free in kfree+0xdc/0x1d4 Free of addr by task sh/4879 Call trace: ... kfree+0xdc/0x1d4 createordeletesynthevent+0x60/0x1e8 traceparseruncommand+0x2bc/0x4b8 syntheventswrite+0x20/0x30 vfswrite+0x200/0x830 ...
Allocated by task 4879: ... kstrdup+0x5c/0x98 createordeletesynthevent+0x6c/0x1e8 traceparseruncommand+0x2bc/0x4b8 syntheventswrite+0x20/0x30 vfswrite+0x200/0x830 ...
Freed by task 5464: ... kfree+0xdc/0x1d4 createordeletesynthevent+0x60/0x1e8 traceparseruncommand+0x2bc/0x4b8 syntheventswrite+0x20/0x30 vfswrite+0x200/0x830 ...
================================================================ Appendix 2. KASAN report use-after-free:
BUG: KASAN: use-after-free in strlen+0x5c/0x7c Read of size 1 at addr by task sh/5483 sh: CPU: 7 PID: 5483 Comm: sh ... asanreportload1noabort+0x34/0x44 strlen+0x5c/0x7c tracinglogerr+0x60/0x444 createordeletesynthevent+0xc4/0x204 traceparseruncommand+0x2bc/0x4b8 syntheventswrite+0x20/0x30 vfswrite+0x200/0x830 ...
Allocated by task 5483: ... kstrdup+0x5c/0x98 createordeletesynthevent+0x80/0x204 traceparseruncommand+0x2bc/0x4b8 syntheventswrite+0x20/0x30 vfswrite+0x200/0x830 ...
Freed by task 5480: ... kfree+0xdc/0x1d4 createordeletesynthevent+0x74/0x204 traceparseruncommand+0x2bc/0x4b8 syntheventswrite+0x20/0x30 vfswrite+0x200/0x830 ...
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the change described as "tracing/synthetic: Fix races on freeing last_cmd" by adding lastcmd_mutex to prevent last_cmd from being accessed concurrently by multiple processes when writing to /sys/kernel/tracing/synthetic_events.
Linux kernel tracing (tracing/synthetic) lastcmd_mutex synchronization for synthetic_events last_cmd = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2023-53478?
CVE-2023-53478 has been assigned a severity rating that indicates it poses a medium risk due to potential race conditions.
How do I fix CVE-2023-53478?
To fix CVE-2023-53478, users should update the Linux kernel to a version that includes the patch for this vulnerability.
What systems are affected by CVE-2023-53478?
CVE-2023-53478 affects multiple versions of the Linux kernel, particularly those that involve the synthetic_events node.
What is the primary issue presented by CVE-2023-53478?
The primary issue in CVE-2023-53478 involves race conditions on the 'last_cmd' variable, which can be accessed asynchronously by multiple processes.
Have any mitigations been recommended for CVE-2023-53478?
No specific mitigations outside of upgrading the kernel have been recommended for CVE-2023-53478.