In the Linux kernel, the following vulnerability has been resolved:
tracing: Free error logs of tracing instances
When a tracing instance is removed, the error messages that hold errors that occurred in the instance needs to be freed. The following reports a memory leak:
# cd /sys/kernel/tracing # mkdir instances/foo # echo 'hist:keys=x' > instances/foo/events/sched/schedswitch/trigger # cat instances/foo/errorlog [ 117.404795] hist:sched:sched_switch: error: Couldn't find field Command: hist:keys=x ^ # rmdir instances/foo
Then check for memory leaks:
# echo scan > /sys/kernel/debug/kmemleak
# cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff88810d8ec700 (size 192):
comm "bash", pid 869, jiffies 4294950577 (age 215.752s)
hex dump (first 32 bytes):
60 dd 68 61 81 88 ff ff 60 dd 68 61 81 88 ff ff .ha.....ha....
a0 30 8c 83 ff ff ff ff 26 00 0a 00 00 00 00 00 .0......&.......
backtrace:
[<00000000dae26536>] kmalloctrace+0x2a/0xa0
[<00000000b2938940>] tracinglogerr+0x277/0x2e0
[<000000004a0e1b07>] parseatom+0x966/0xb40
[<0000000023b24337>] parseexpr+0x5f3/0xdb0
[<00000000594ad074>] eventhisttriggerparse+0x27f8/0x3560
[<00000000293a9645>] triggerprocessregex+0x135/0x1a0
[<000000005c22b4f2>] eventtriggerwrite+0x87/0xf0
[<000000002cadc509>] vfswrite+0x162/0x670
[<0000000059c3b9be>] ksyswrite+0xca/0x170
[<00000000f1cddc00>] dosyscall64+0x3e/0xc0
[<00000000868ac68c>] entrySYSCALL64afterhwframe+0x72/0xdc
unreferenced object 0xffff888170c35a00 (size 32):
comm "bash", pid 869, jiffies 4294950577 (age 215.752s)
hex dump (first 32 bytes):
0a 20 20 43 6f 6d 6d 61 6e 64 3a 20 68 69 73 74 . Command: hist
3a 6b 65 79 73 3d 78 0a 00 00 00 00 00 00 00 00 :keys=x.........
backtrace:
[<000000006a747de5>] _kmalloc+0x4d/0x160
[<000000000039df5f>] tracinglogerr+0x29b/0x2e0
[<000000004a0e1b07>] parseatom+0x966/0xb40
[<0000000023b24337>] parseexpr+0x5f3/0xdb0
[<00000000594ad074>] eventhisttriggerparse+0x27f8/0x3560
[<00000000293a9645>] triggerprocessregex+0x135/0x1a0
[<000000005c22b4f2>] eventtriggerwrite+0x87/0xf0
[<000000002cadc509>] vfswrite+0x162/0x670
[<0000000059c3b9be>] ksyswrite+0xca/0x170
[<00000000f1cddc00>] dosyscall64+0x3e/0xc0
[<00000000868ac68c>] entrySYSCALL64afterhwframe+0x72/0xdc
The problem is that the error log needs to be freed when the instance is removed.
[
{
"deprecated": false,
"id": "CVE-2023-53375-193591aa",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0cf0f55be043ef67c38f492aa37ed1986d2f6b6",
"signature_version": "v1",
"target": {
"function": "__remove_instance",
"file": "kernel/trace/trace.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "117739402434791414114842268002419363769",
"length": 742.0
}
},
{
"deprecated": false,
"id": "CVE-2023-53375-2a9bb796",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e36373aa5ffa8e00fe7c71b3209f6f17081e552",
"signature_version": "v1",
"target": {
"function": "__remove_instance",
"file": "kernel/trace/trace.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "229831006494423840235434408948504179560",
"length": 700.0
}
},
{
"deprecated": false,
"id": "CVE-2023-53375-2acadd2f",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33d5d4e67a0e13c3ca6257fa67bf6503bc000878",
"signature_version": "v1",
"target": {
"function": "__remove_instance",
"file": "kernel/trace/trace.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "117739402434791414114842268002419363769",
"length": 742.0
}
},
{
"deprecated": false,
"id": "CVE-2023-53375-326877c1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@33d5d4e67a0e13c3ca6257fa67bf6503bc000878",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"141295810134684603826094994714236065369",
"139730559387206365141683849029592447832",
"56068242036235817391996263269437086689",
"200156989424822713204916449345440065339"
]
}
},
{
"deprecated": false,
"id": "CVE-2023-53375-4095470d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3357c6e429643231e60447b52ffbb7ac895aca22",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"141295810134684603826094994714236065369",
"139730559387206365141683849029592447832",
"56068242036235817391996263269437086689",
"200156989424822713204916449345440065339"
]
}
},
{
"deprecated": false,
"id": "CVE-2023-53375-456bfc68",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3357c6e429643231e60447b52ffbb7ac895aca22",
"signature_version": "v1",
"target": {
"function": "__remove_instance",
"file": "kernel/trace/trace.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "117739402434791414114842268002419363769",
"length": 742.0
}
},
{
"deprecated": false,
"id": "CVE-2023-53375-57e131f7",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987f599fc556a4e64c405d8dde32c70311e8c278",
"signature_version": "v1",
"target": {
"function": "__remove_instance",
"file": "kernel/trace/trace.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "45959660524368450834574843582667976359",
"length": 711.0
}
},
{
"deprecated": false,
"id": "CVE-2023-53375-5f32a89d",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46771c34d6721abfd9e7903eaed2201051eebec6",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"141295810134684603826094994714236065369",
"139730559387206365141683849029592447832",
"56068242036235817391996263269437086689",
"200156989424822713204916449345440065339"
]
}
},
{
"deprecated": false,
"id": "CVE-2023-53375-b24fca7e",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@46771c34d6721abfd9e7903eaed2201051eebec6",
"signature_version": "v1",
"target": {
"function": "__remove_instance",
"file": "kernel/trace/trace.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "117739402434791414114842268002419363769",
"length": 742.0
}
},
{
"deprecated": false,
"id": "CVE-2023-53375-c7253a3c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0cf0f55be043ef67c38f492aa37ed1986d2f6b6",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"141295810134684603826094994714236065369",
"139730559387206365141683849029592447832",
"56068242036235817391996263269437086689",
"200156989424822713204916449345440065339"
]
}
},
{
"deprecated": false,
"id": "CVE-2023-53375-d51928cb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e36373aa5ffa8e00fe7c71b3209f6f17081e552",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"178620385939570406052115600939787977324",
"278439680030035781913794296468841510084",
"35159611629002730959623500463406365705",
"200156989424822713204916449345440065339"
]
}
},
{
"deprecated": false,
"id": "CVE-2023-53375-fdcd8022",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@987f599fc556a4e64c405d8dde32c70311e8c278",
"signature_version": "v1",
"target": {
"file": "kernel/trace/trace.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169815774872408048267358798403366881075",
"25772127211884617185213691122363321245",
"206534761875002151323880690913336949329",
"200156989424822713204916449345440065339"
]
}
}
]