{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53478","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-10-01T11:39:39.401Z","datePublished":"2025-10-01T11:42:47.185Z","dateUpdated":"2026-08-05T09:14:16.799Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T09:14:16.799Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/synthetic: Fix races on freeing last_cmd\n\nCurrently, the \"last_cmd\" variable can be accessed by multiple processes\nasynchronously when multiple users manipulate synthetic_events node\nat the same time, it could lead to use-after-free or double-free.\n\nThis patch add \"lastcmd_mutex\" to prevent \"last_cmd\" from being accessed\nasynchronously.\n\n================================================================\n\nIt's easy to reproduce in the KASAN environment by running the two\nscripts below in different shells.\n\nscript 1:\n        while :\n        do\n                echo -n -e '\\x88' > /sys/kernel/tracing/synthetic_events\n        done\n\nscript 2:\n        while :\n        do\n                echo -n -e '\\xb0' > /sys/kernel/tracing/synthetic_events\n        done\n\n================================================================\ndouble-free scenario:\n\n    process A                       process B\n-------------------               ---------------\n1.kstrdup last_cmd\n                                  2.free last_cmd\n3.free last_cmd(double-free)\n\n================================================================\nuse-after-free scenario:\n\n    process A                       process B\n-------------------               ---------------\n1.kstrdup last_cmd\n                                  2.free last_cmd\n3.tracing_log_err(use-after-free)\n\n================================================================\n\nAppendix 1. KASAN report double-free:\n\nBUG: KASAN: double-free in kfree+0xdc/0x1d4\nFree of addr ***** by task sh/4879\nCall trace:\n        ...\n        kfree+0xdc/0x1d4\n        create_or_delete_synth_event+0x60/0x1e8\n        trace_parse_run_command+0x2bc/0x4b8\n        synth_events_write+0x20/0x30\n        vfs_write+0x200/0x830\n        ...\n\nAllocated by task 4879:\n        ...\n        kstrdup+0x5c/0x98\n        create_or_delete_synth_event+0x6c/0x1e8\n        trace_parse_run_command+0x2bc/0x4b8\n        synth_events_write+0x20/0x30\n        vfs_write+0x200/0x830\n        ...\n\nFreed by task 5464:\n        ...\n        kfree+0xdc/0x1d4\n        create_or_delete_synth_event+0x60/0x1e8\n        trace_parse_run_command+0x2bc/0x4b8\n        synth_events_write+0x20/0x30\n        vfs_write+0x200/0x830\n        ...\n\n================================================================\nAppendix 2. KASAN report use-after-free:\n\nBUG: KASAN: use-after-free in strlen+0x5c/0x7c\nRead of size 1 at addr ***** by task sh/5483\nsh: CPU: 7 PID: 5483 Comm: sh\n        ...\n        __asan_report_load1_noabort+0x34/0x44\n        strlen+0x5c/0x7c\n        tracing_log_err+0x60/0x444\n        create_or_delete_synth_event+0xc4/0x204\n        trace_parse_run_command+0x2bc/0x4b8\n        synth_events_write+0x20/0x30\n        vfs_write+0x200/0x830\n        ...\n\nAllocated by task 5483:\n        ...\n        kstrdup+0x5c/0x98\n        create_or_delete_synth_event+0x80/0x204\n        trace_parse_run_command+0x2bc/0x4b8\n        synth_events_write+0x20/0x30\n        vfs_write+0x200/0x830\n        ...\n\nFreed by task 5480:\n        ...\n        kfree+0xdc/0x1d4\n        create_or_delete_synth_event+0x74/0x204\n        trace_parse_run_command+0x2bc/0x4b8\n        synth_events_write+0x20/0x30\n        vfs_write+0x200/0x830\n        ..."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bug is triggered only by write() to the tracefs node /sys/kernel/tracing/synthetic_events (or dynamic_events), which requires local access to the machine's filesystem. There is no network-facing consumer of this code path.\nAC:L - Although it is a race, the attacker owns both sides — simply running two concurrent writers of malformed commands, exactly as the reporter's two-shell reproducer does, and the commit states it reproduces easily. Object size and contents of the raced allocation are fully attacker-chosen, so no condition lies outside the attacker's control.\nPR:L - No capability check exists in the path; access is gated only by DAC on the tracefs file, and tracefs's gid= mount option is explicitly provided so a non-root tracing group (Android/ChromeOS/developer-group deployments) can write these nodes. An unprivileged member of that group can trigger the race with plain writes.\nUI:N - The attacker performs the entire attack with its own write() calls; no victim action, mount, or file-open by another user is needed.\nS:U - The corruption occurs in kernel slab memory and its impact stays within the same kernel security authority, with no crossing of a hypervisor, IOMMU, or sandbox boundary.\nC:H - The use-after-free reads freed heap memory via strlen()/snprintf() in tracing_log_err() and copies it into err->cmd, which userspace can then read back from tracing/error_log — a direct kernel heap infoleak. Combined with the double-free's ability to overlap allocations, arbitrary kernel memory disclosure is achievable.\nI:H - The double-free frees an attacker-sized, attacker-filled kmalloc object twice, corrupting the SLUB freelist and letting two live allocations alias the same memory — a well-known route to arbitrary kernel write and control-flow hijack.\nA:H - The double-free and use-after-free readily produce slab corruption, KASAN BUG reports, and kernel panics, and the race can be re-triggered in a tight loop to reliably crash the system."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_events_synth.c"],"versions":[{"version":"27c888da9867725784bad3d6455d6e53b425fa2b","lessThan":"9fe183f659a2704255e5d84f6ae308c234a113ec","status":"affected","versionType":"git"},{"version":"27c888da9867725784bad3d6455d6e53b425fa2b","lessThan":"8826d9e7bd51e7656f78baa4472e8e2f5e7069f0","status":"affected","versionType":"git"},{"version":"27c888da9867725784bad3d6455d6e53b425fa2b","lessThan":"4ccf11c4e8a8e051499d53a12f502196c97a758e","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/trace/trace_events_synth.c"],"versions":[{"version":"5.18","status":"affected"},{"version":"0","lessThan":"5.18","status":"unaffected","versionType":"semver"},{"version":"6.1.24","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.2.11","lessThanOrEqual":"6.2.*","status":"unaffected","versionType":"semver"},{"version":"6.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.1.24"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.2.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.18","versionEndExcluding":"6.3"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/9fe183f659a2704255e5d84f6ae308c234a113ec"},{"url":"https://git.kernel.org/stable/c/8826d9e7bd51e7656f78baa4472e8e2f5e7069f0"},{"url":"https://git.kernel.org/stable/c/4ccf11c4e8a8e051499d53a12f502196c97a758e"}],"title":"tracing/synthetic: Fix races on freeing last_cmd","x_generator":{"engine":"bippy-1.2.0"}}}}