CVE-2023-53167

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix null pointer dereference in tracingerrlog_open()

Fix an issue in function 'tracingerrlogopen'. The function doesn't call 'seqopen' if the file is opened only with write permissions, which results in 'file->privatedata' being left as null. If we then use 'lseek' on that opened file, 'seqlseek' dereferences 'file->privatedata' in 'mutexlock(&m->lock)', resulting in a kernel panic. Writing to this node requires root privileges, therefore this bug has very little security impact.

Tracefs node: /sys/kernel/tracing/error_log

Example Kernel panic:

Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 Call trace: mutexlock+0x30/0x110 seqlseek+0x34/0xb8 _arm64syslseek+0x6c/0xb8 invokesyscall+0x58/0x13c el0svccommon+0xc4/0x10c doel0svc+0x24/0x98 el0svc+0x24/0x88 el0t64synchandler+0x84/0xe4 el0t64sync+0x1b4/0x1b8 Code: d503201f aa0803e0 aa1f03e1 aa0103e9 (c8e97d02) ---[ end trace 561d1b49c12cf8a5 ]--- Kernel panic - not syncing: Oops: Fatal exception