Linux Kernel Performance Events System kernel/events/core.c perf_group_detach use after free

Summaryinfo

A vulnerability has been found in Linux Kernel and classified as critical. The affected element is the function perf_group_detach of the file kernel/events/core.c of the component Performance Events System. The manipulation leads to use after free. This vulnerability is listed as CVE-2023-2235. The attack must be carried out locally. There is no available exploit. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linux Kernel (Operating System) (the affected version unknown). This issue affects the function perf_group_detach of the file kernel/events/core.c of the component Performance Events System. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but remove_on_exec made it possible to call list_del_event() on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability. We recommend upgrading past commit fd0815f632c24878e325821943edccc7fde947a2.

The weakness was presented 05/01/2023. It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2023-2235 since 04/21/2023. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 05/01/2023).

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.kernel.org.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion