CVE-2023-53375
BaseFortify
Publication date: 2025-09-18
Last updated on: 2025-12-12
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.2 (inc) to 5.4.241 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.178 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.107 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.1.24 (exc) |
| linux | linux_kernel | From 6.2 (inc) to 6.2.11 (exc) |
| linux | linux_kernel | 6.3 |
| linux | linux_kernel | 6.3 |
| linux | linux_kernel | 6.3 |
| linux | linux_kernel | 6.3 |
| linux | linux_kernel | 6.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a memory leak in the Linux kernel's tracing subsystem. When a tracing instance is removed, the error messages associated with that instance, which hold errors that occurred during tracing, are not properly freed from memory. This causes memory to be wasted and not reclaimed, leading to a memory leak.
How can this vulnerability impact me? :
The memory leak caused by this vulnerability can lead to increased memory usage over time, potentially degrading system performance or causing resource exhaustion. This could affect system stability, especially on systems that frequently create and remove tracing instances.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for memory leaks related to tracing instances in the Linux kernel. The following commands can be used to reproduce the issue and check for memory leaks: 1. Navigate to the tracing directory: # cd /sys/kernel/tracing 2. Create a tracing instance: # mkdir instances/foo 3. Trigger an error by writing an invalid command: # echo 'hist:keys=x' > instances/foo/events/sched/sched_switch/trigger 4. View the error log: # cat instances/foo/error_log 5. Remove the tracing instance: # rmdir instances/foo 6. Check for memory leaks using kmemleak: # echo scan > /sys/kernel/debug/kmemleak # cat /sys/kernel/debug/kmemleak These steps help identify unreferenced objects indicating memory leaks caused by the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to ensure that the Linux kernel is updated to a version where this vulnerability is resolved. The fix involves freeing the error logs of tracing instances when they are removed to prevent memory leaks. Until the kernel is patched, avoid creating and removing tracing instances with error logs that could trigger the memory leak.