{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-52879", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-05-21T15:19:24.265Z", "datePublished": "2024-05-21T15:32:11.263Z", "dateUpdated": "2026-08-05T09:11:48.431Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:11:48.431Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Have trace_event_file have ref counters\n\nThe following can crash the kernel:\n\n # cd /sys/kernel/tracing\n # echo 'p:sched schedule' > kprobe_events\n # exec 5>>events/kprobes/sched/enable\n # > kprobe_events\n # exec 5>&-\n\nThe above commands:\n\n 1. Change directory to the tracefs directory\n 2. Create a kprobe event (doesn't matter what one)\n 3. Open bash file descriptor 5 on the enable file of the kprobe event\n 4. Delete the kprobe event (removes the files too)\n 5. Close the bash file descriptor 5\n\nThe above causes a crash!\n\n BUG: kernel NULL pointer dereference, address: 0000000000000028\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: 0000 [#1] PREEMPT SMP PTI\n CPU: 6 PID: 877 Comm: bash Not tainted 6.5.0-rc4-test-00008-g2c6b6b1029d4-dirty #186\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014\n RIP: 0010:tracing_release_file_tr+0xc/0x50\n\nWhat happens here is that the kprobe event creates a trace_event_file\n\"file\" descriptor that represents the file in tracefs to the event. It\nmaintains state of the event (is it enabled for the given instance?).\nOpening the \"enable\" file gets a reference to the event \"file\" descriptor\nvia the open file descriptor. When the kprobe event is deleted, the file is\nalso deleted from the tracefs system which also frees the event \"file\"\ndescriptor.\n\nBut as the tracefs file is still opened by user space, it will not be\ntotally removed until the final dput() is called on it. But this is not\ntrue with the event \"file\" descriptor that is already freed. If the user\ndoes a write to or simply closes the file descriptor it will reference the\nevent \"file\" descriptor that was just freed, causing a use-after-free bug.\n\nTo solve this, add a ref count to the event \"file\" descriptor as well as a\nnew flag called \"FREED\". The \"file\" will not be freed until the last\nreference is released. But the FREE flag will be set when the event is\nremoved to prevent any more modifications to that event from happening,\neven if there's still a reference to the event \"file\" descriptor." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug is triggered only through local tracefs operations (open enable/filter under /sys/kernel/tracing, write kprobe_events to delete the event, then close/write the still-open FD). There is no network-facing or remote-packet path into this code.\nAC:L - The sequence is fully deterministic and attacker-driven—create a dynamic event, hold its enable/filter FD open, delete the event, then close or write—with no race or other condition outside the attacker’s control.\nPR:L - Access is gated only by DAC on tracefs; there is no capability check on this path, and the documented gid= mount option is used in Android/ChromeOS/developer deployments so a non-root member of the tracing group can create/delete kprobes and open enable/filter files.\nUI:N - The attacker performs the entire open/delete/close-or-write sequence in their own process; no other user or administrator action is required.\nS:U - The use-after-free corrupts kernel slab state within the same kernel security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free of struct trace_event_file: after deletion the dangling pointer remains reachable via the open FD, so reclaim/spray of the object yields a read primitive over attacker-controlled kernel heap contents.\nI:H - The UAF is reachable on write (event_enable_write/apply_event_filter) and on release (tracing_release_file_tr → file->tr), so a reclaimed object can redirect those paths through attacker-controlled pointers and function-pointer fields for kernel write/control-flow hijack.\nA:H - Even without full exploitation, the commit’s reproducer causes a kernel NULL-pointer oops in tracing_release_file_tr, and the UAF can be re-triggered at will to crash the system." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/trace_events.h", "kernel/trace/trace.c", "kernel/trace/trace.h", "kernel/trace/trace_events.c", "kernel/trace/trace_events_filter.c" ], "versions": [ { "version": "e6807c873d8791ae5a5186ad05ec66cab926539a", "lessThan": "961c4511c7578d6b8f39118be919016ec3db1c1e", "status": "affected", "versionType": "git" }, { "version": "407bf1c140f0757706c0b28604bcc90837d45ce2", "lessThan": "a98172e36e5f1b3d29ad71fade2d611cfcc2fe6f", "status": "affected", "versionType": "git" }, { "version": "fa6d449e4d024d8c17f4288e0567d28ace69415c", "lessThan": "cbc7c29dff0fa18162f2a3889d82eeefd67305e0", "status": "affected", "versionType": "git" }, { "version": "a46bf337a20f9edd3c8041b025639842280d0575", "lessThan": "2fa74d29fc1899c237d51bf9a6e132ea5c488976", "status": "affected", "versionType": "git" }, { "version": "9beec04370132a7a6cd1aa9897f6fffc6262ff28", "lessThan": "2c9de867ca285c397cd71af703763fe416265706", "status": "affected", "versionType": "git" }, { "version": "f5ca233e2e66dc1c249bf07eefa37e34a6c9346a", "lessThan": "9034c87d61be8cff989017740a91701ac8195a1d", "status": "affected", "versionType": "git" }, { "version": "f5ca233e2e66dc1c249bf07eefa37e34a6c9346a", "lessThan": "bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4", "status": "affected", "versionType": "git" }, { "version": "5.4.258", "lessThan": "5.4.262", "status": "affected", "versionType": "semver" }, { "version": "5.10.198", "lessThan": "5.10.202", "status": "affected", "versionType": "semver" }, { "version": "5.15.134", "lessThan": "5.15.140", "status": "affected", "versionType": "semver" }, { "version": "6.1.55", "lessThan": "6.1.64", "status": "affected", "versionType": "semver" }, { "version": "6.5.5", "lessThan": "6.5.13", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/trace_events.h", "kernel/trace/trace.c", "kernel/trace/trace.h", "kernel/trace/trace_events.c", "kernel/trace/trace_events_filter.c" ], "versions": [ { "version": "6.6", "status": "affected" }, { "version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.262", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.202", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.140", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.64", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.5.13", "lessThanOrEqual": "6.5.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.1", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.7", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.258", "versionEndExcluding": "5.4.262" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.198", "versionEndExcluding": "5.10.202" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.134", "versionEndExcluding": "5.15.140" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.55", "versionEndExcluding": "6.1.64" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.5.5", "versionEndExcluding": "6.5.13" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.6.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.7" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/961c4511c7578d6b8f39118be919016ec3db1c1e" }, { "url": "https://git.kernel.org/stable/c/a98172e36e5f1b3d29ad71fade2d611cfcc2fe6f" }, { "url": "https://git.kernel.org/stable/c/cbc7c29dff0fa18162f2a3889d82eeefd67305e0" }, { "url": "https://git.kernel.org/stable/c/2fa74d29fc1899c237d51bf9a6e132ea5c488976" }, { "url": "https://git.kernel.org/stable/c/2c9de867ca285c397cd71af703763fe416265706" }, { "url": "https://git.kernel.org/stable/c/9034c87d61be8cff989017740a91701ac8195a1d" }, { "url": "https://git.kernel.org/stable/c/bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4" } ], "title": "tracing: Have trace_event_file have ref counters", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CISA ADP Vulnrichment", "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2023-52879", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-05-21T16:59:47.559597Z" } } } ], "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:23:30.864Z" } }, { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:18:41.182Z" }, "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/961c4511c7578d6b8f39118be919016ec3db1c1e", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/a98172e36e5f1b3d29ad71fade2d611cfcc2fe6f", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/cbc7c29dff0fa18162f2a3889d82eeefd67305e0", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/2fa74d29fc1899c237d51bf9a6e132ea5c488976", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/2c9de867ca285c397cd71af703763fe416265706", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/9034c87d61be8cff989017740a91701ac8195a1d", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/bb32500fb9b78215e4ef6ee8b4345c5f5d7eafb4", "tags": [ "x_transferred" ] } ] } ] } }