CVE-2023-53718

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ring-buffer: Do not swap cpu_buffer during resize process

When ring_buffer_swap_cpu was called during resize process,

the cpu buffer was swapped in the middle, resulting in incorrect state.

Continuing to run in the wrong state will result in oops.

This issue can be easily reproduced using the following two scripts:

/tmp # cat test1.sh

//#! /bin/sh

for i in `seq 0 100000`

do

echo 2000 > /sys/kernel/debug/tracing/buffer_size_kb

sleep 0.5

echo 5000 > /sys/kernel/debug/tracing/buffer_size_kb

sleep 0.5

done

/tmp # cat test2.sh

//#! /bin/sh

for i in `seq 0 100000`

do

echo irqsoff > /sys/kernel/debug/tracing/current_tracer

sleep 1

echo nop > /sys/kernel/debug/tracing/current_tracer

sleep 1

done

/tmp # ./test1.sh &

/tmp # ./test2.sh &

A typical oops log is as follows, sometimes with other different oops logs.

[ 231.711293] WARNING: CPU: 0 PID: 9 at kerne

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References