CVE-2023-53221
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-15

Last updated on: 2025-12-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix memleak due to fentry attach failure If it fails to attach fentry, the allocated bpf trampoline image will be left in the system. That can be verified by checking /proc/kallsyms. This meamleak can be verified by a simple bpf program as follows: SEC("fentry/trap_init") int fentry_run() { return 0; } It will fail to attach trap_init because this function is freed after kernel init, and then we can find the trampoline image is left in the system by checking /proc/kallsyms. $ tail /proc/kallsyms ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf] ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf] $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'" [2522] FUNC 'trap_init' type_id=119 linkage=static $ echo $((6442453466 & 0x7fffffff)) 2522 Note that there are two left bpf trampoline images, that is because the libbpf will fallback to raw tracepoint if -EINVAL is returned.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-15
Last Modified
2025-12-03
Generated
2026-05-07
AI Q&A
2025-09-15
EPSS Evaluated
2026-05-05
NVD
CVE-2023-53221
Affected Vendors & Products
Showing 10 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 5.10.28 (inc) to 5.11 (exc)
linux linux_kernel From 5.11.11 (inc) to 5.12 (exc)
linux linux_kernel From 5.12.1 (inc) to 6.1.39 (exc)
linux linux_kernel From 6.2 (inc) to 6.3.13 (exc)
linux linux_kernel From 6.4 (inc) to 6.4.4 (exc)
linux linux_kernel 5.12
linux linux_kernel 5.12
linux linux_kernel 5.12
linux linux_kernel 5.12
linux linux_kernel 5.12
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in the Linux kernel involves a memory leak caused by a failure to attach a function entry (fentry) probe. When the kernel fails to attach the fentry probe, the allocated BPF trampoline image remains in the system instead of being freed. This leftover trampoline image can be observed in the system's /proc/kallsyms file. The issue occurs because the target function (trap_init) is freed after kernel initialization, causing the attach to fail and the memory allocated for the trampoline to leak.


How can this vulnerability impact me? :

The impact of this vulnerability is a memory leak in the Linux kernel due to leftover BPF trampoline images when fentry attach fails. Over time, this could lead to increased memory usage and potential resource exhaustion, which might degrade system performance or stability.


How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by checking for leftover BPF trampoline images in the system. You can verify this by examining the contents of /proc/kallsyms for entries like 'bpf_trampoline_*'. Example commands include: $ tail /proc/kallsyms $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'" $ echo $((6442453466 & 0x7fffffff)) These commands help identify if the fentry attach to 'trap_init' failed and left trampoline images in the system.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart