In the Linux kernel, the following vulnerability has been resolved:
tracing/histograms: Add histograms to hist_vars if they have referenced variables
Hist triggers can have referenced variables without having direct variables fields. This can be the case if referenced variables are added for trigger actions. In this case the newly added references will not have field variables. Not taking such referenced variables into consideration can result in a bug where it would be possible to remove hist trigger with variables being refenced. This will result in a bug that is easily reproducable like so
$ cd /sys/kernel/tracing $ echo 'syntheticsysenter char[] comm; long id' >> syntheticevents $ echo 'hist:keys=commonpid.execname,id.syscall:vals=hitcount:comm=commonpid.execname' >> events/rawsyscalls/sysenter/trigger $ echo 'hist:keys=commonpid.execname,id.syscall:onmatch(rawsyscalls.sysenter).syntheticsysenter($comm, id)' >> events/rawsyscalls/sysenter/trigger $ echo '!hist:keys=commonpid.execname,id.syscall:vals=hitcount:comm=commonpid.execname' >> events/rawsyscalls/sysenter/trigger
[ 100.263533] ================================================================== [ 100.264634] BUG: KASAN: slab-use-after-free in resolvevarrefs+0xc7/0x180 [ 100.265520] Read of size 8 at addr ffff88810375d0f0 by task bash/439 [ 100.266320] [ 100.266533] CPU: 2 PID: 439 Comm: bash Not tainted 6.5.0-rc1 #4 [ 100.267277] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-20220807005459-localhost 04/01/2014 [ 100.268561] Call Trace: [ 100.268902] <TASK> [ 100.269189] dumpstacklvl+0x4c/0x70 [ 100.269680] printreport+0xc5/0x600 [ 100.270165] ? resolvevarrefs+0xc7/0x180 [ 100.270697] ? kasancompletemodereportinfo+0x80/0x1f0 [ 100.271389] ? resolvevarrefs+0xc7/0x180 [ 100.271913] kasanreport+0xbd/0x100 [ 100.272380] ? resolvevarrefs+0xc7/0x180 [ 100.272920] asanload8+0x71/0xa0 [ 100.273377] resolvevarrefs+0xc7/0x180 [ 100.273888] eventhisttrigger+0x749/0x860 [ 100.274505] ? kasansavestack+0x2a/0x50 [ 100.275024] ? kasansettrack+0x29/0x40 [ 100.275536] ? _pfxeventhisttrigger+0x10/0x10 [ 100.276138] ? ksyswrite+0xd1/0x170 [ 100.276607] ? dosyscall64+0x3c/0x90 [ 100.277099] ? entrySYSCALL64afterhwframe+0x6e/0xd8 [ 100.277771] ? destroyhistdata+0x446/0x470 [ 100.278324] ? eventhisttriggerparse+0xa6c/0x3860 [ 100.278962] ? _pfxeventhisttriggerparse+0x10/0x10 [ 100.279627] ? _kasancheckwrite+0x18/0x20 [ 100.280177] ? mutexunlock+0x85/0xd0 [ 100.280660] ? _pfxmutexunlock+0x10/0x10 [ 100.281200] ? kfree+0x7b/0x120 [ 100.281619] ? kasanslabfree+0x15d/0x1d0 [ 100.282197] ? eventtriggerwrite+0xac/0x100 [ 100.282764] ? _kasanslabfree+0x16/0x20 [ 100.283293] ? _kmemcachefree+0x153/0x2f0 [ 100.283844] ? schedmmcidremoteclear+0xb1/0x250 [ 100.284550] ? _pfxschedmmcidremoteclear+0x10/0x10 [ 100.285221] ? eventtriggerwrite+0xbc/0x100 [ 100.285781] ? _kasancheckread+0x15/0x20 [ 100.286321] ? _bitmapweight+0x66/0xa0 [ 100.286833] ? _findnextbit+0x46/0xe0 [ 100.287334] ? taskmmcidwork+0x37f/0x450 [ 100.287872] eventtriggerscall+0x84/0x150 [ 100.288408] traceeventbuffercommit+0x339/0x430 [ 100.289073] ? ringbuffereventdata+0x3f/0x60 [ 100.292189] traceeventraweventsysenter+0x8b/0xe0 [ 100.295434] syscalltraceenter.constprop.0+0x18f/0x1b0 [ 100.298653] syscallenterfromusermode+0x32/0x40 [ 100.301808] dosyscall64+0x1a/0x90 [ 100.304748] entrySYSCALL64afterhwframe+0x6e/0xd8 [ 100.307775] RIP: 0033:0x7f686c75c1cb [ 100.310617] Code: 73 01 c3 48 8b 0d 65 3c 10 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 21 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 35 3c 10 00 f7 d8 64 89 01 48 [ 100.317847] RSP: 002b:00007ffc60137a38 EFLAGS: 00000246 ORIGRAX: 0000000000000021 [ 100.321200] RA ---truncated---
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53560.json"
}"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-53560.json"
[
{
"id": "CVE-2023-53560-0e51f11a",
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ffad1528e81c91769d9da1f8436080861c8ec67",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326276346042822435911002992900991661261",
"256903218006596741690695687574263964774",
"196472633314115854608256781216784539434",
"270398302074229084861921161851454536477",
"237234300089661326591849348710377613600",
"112464996816545682093797378583772581725",
"268188028945017275865253894117433553610",
"306450001121802478918743089306690676581"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53560-2002ce5a",
"target": {
"function": "event_hist_trigger_func",
"file": "kernel/trace/trace_events_hist.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4ffad1528e81c91769d9da1f8436080861c8ec67",
"digest": {
"function_hash": "292294076337425900199187912965746336207",
"length": 2932.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53560-207dff74",
"target": {
"function": "event_hist_trigger_parse",
"file": "kernel/trace/trace_events_hist.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5fd32eb6fa0ac795aa5a64bc004ab68d7b44196a",
"digest": {
"function_hash": "192871352340932804121840471883128614877",
"length": 2615.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53560-218d47ca",
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6018b585e8c6fa7d85d4b38d9ce49a5b67be7078",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326276346042822435911002992900991661261",
"256903218006596741690695687574263964774",
"298533385187635065513596962680878914339",
"16819298548208289067885706358717110382",
"212134834297722763304305399784631714003",
"261342978090085574559281021126447527270",
"268188028945017275865253894117433553610",
"306450001121802478918743089306690676581"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53560-2dfcc933",
"target": {
"function": "event_hist_trigger_func",
"file": "kernel/trace/trace_events_hist.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4815359056083c555f97a5ee3af86519be5166de",
"digest": {
"function_hash": "285168083696225278288390910962939084766",
"length": 2845.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53560-4a92d761",
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a540f63618e525e433b37d2b5522cda08e321d7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326276346042822435911002992900991661261",
"256903218006596741690695687574263964774",
"298533385187635065513596962680878914339",
"16819298548208289067885706358717110382",
"212134834297722763304305399784631714003",
"261342978090085574559281021126447527270",
"268188028945017275865253894117433553610",
"306450001121802478918743089306690676581"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53560-57ba636a",
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4815359056083c555f97a5ee3af86519be5166de",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326276346042822435911002992900991661261",
"256903218006596741690695687574263964774",
"298533385187635065513596962680878914339",
"16819298548208289067885706358717110382",
"212134834297722763304305399784631714003",
"261342978090085574559281021126447527270",
"268188028945017275865253894117433553610",
"306450001121802478918743089306690676581"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53560-641bf57b",
"target": {
"function": "event_hist_trigger_parse",
"file": "kernel/trace/trace_events_hist.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6018b585e8c6fa7d85d4b38d9ce49a5b67be7078",
"digest": {
"function_hash": "192871352340932804121840471883128614877",
"length": 2615.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53560-6f2f87ee",
"target": {
"function": "event_hist_trigger_parse",
"file": "kernel/trace/trace_events_hist.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4a540f63618e525e433b37d2b5522cda08e321d7",
"digest": {
"function_hash": "192871352340932804121840471883128614877",
"length": 2615.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53560-70b6d772",
"target": {
"function": "event_hist_trigger_func",
"file": "kernel/trace/trace_events_hist.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1576f0df7b4d1f82db588d6654b89d796fa06929",
"digest": {
"function_hash": "285168083696225278288390910962939084766",
"length": 2845.0
},
"signature_type": "Function"
},
{
"id": "CVE-2023-53560-78cda487",
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97f54b330c797ed27fba8791baeaa38ace886cbd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326276346042822435911002992900991661261",
"256903218006596741690695687574263964774",
"298533385187635065513596962680878914339",
"16819298548208289067885706358717110382",
"212134834297722763304305399784631714003",
"261342978090085574559281021126447527270",
"268188028945017275865253894117433553610",
"306450001121802478918743089306690676581"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53560-9360fec9",
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5fd32eb6fa0ac795aa5a64bc004ab68d7b44196a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326276346042822435911002992900991661261",
"256903218006596741690695687574263964774",
"298533385187635065513596962680878914339",
"16819298548208289067885706358717110382",
"212134834297722763304305399784631714003",
"261342978090085574559281021126447527270",
"268188028945017275865253894117433553610",
"306450001121802478918743089306690676581"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53560-d243370c",
"target": {
"file": "kernel/trace/trace_events_hist.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1576f0df7b4d1f82db588d6654b89d796fa06929",
"digest": {
"threshold": 0.9,
"line_hashes": [
"326276346042822435911002992900991661261",
"256903218006596741690695687574263964774",
"298533385187635065513596962680878914339",
"16819298548208289067885706358717110382",
"212134834297722763304305399784631714003",
"261342978090085574559281021126447527270",
"268188028945017275865253894117433553610",
"306450001121802478918743089306690676581"
]
},
"signature_type": "Line"
},
{
"id": "CVE-2023-53560-e19a8760",
"target": {
"function": "event_hist_trigger_func",
"file": "kernel/trace/trace_events_hist.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@97f54b330c797ed27fba8791baeaa38ace886cbd",
"digest": {
"function_hash": "285168083696225278288390910962939084766",
"length": 2845.0
},
"signature_type": "Function"
}
]