CVE-2023-53093

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tracing: Do not let histogram values have some modifiers

Histogram values can not be strings, stacktraces, graphs, symbols,

syscalls, or grouped in buckets or log. Give an error if a value is set to

do so.

Note, the histogram code was not prepared to handle these modifiers for

histograms and caused a bug.

Mark Rutland reported:

# echo 'p:copy_to_user __arch_copy_to_user n=$arg2' >> /sys/kernel/tracing/kprobe_events

# echo 'hist:keys=n:vals=hitcount.buckets=8:sort=hitcount' > /sys/kernel/tracing/events/kprobes/copy_to_user/trigger

# cat /sys/kernel/tracing/events/kprobes/copy_to_user/hist

[ 143.694628] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000

[ 143.695190] Mem abort info:

[ 143.695362] ESR = 0x0000000096000004

[ 143.695604] EC = 0x25: DABT (current EL), IL = 32 bits

[ 143.695889] SET = 0, FnV = 0

[ 143.696077] EA = 0, S1PTW = 0

[ 143.696302] FSC = 0x04

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References