CVE-2023-53655
BaseFortify
Publication date: 2025-10-07
Last updated on: 2026-02-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 6.3 (inc) to 6.3.2 (inc) |
| linux | linux_kernel | 6.2.0-rc2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-674 | The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel when a kprobe is registered on the function __rcu_irq_enter_check_tick(). Doing so can cause a kernel stack overflow, which may lead to a kernel panic. The issue arises because the stack space is insufficient to handle the exception triggered by this kprobe. The vulnerability can be reproduced by enabling CONFIG_NO_HZ_FULL, booting the kernel with the nohz_full= argument, and then enabling kprobes on __rcu_irq_enter_check_tick(). The fix involves blacklisting this function from kprobes to prevent the stack overflow.
How can this vulnerability impact me? :
This vulnerability can cause a kernel stack overflow leading to a kernel panic, which results in the system crashing and becoming unresponsive. This can cause denial of service on affected systems, potentially interrupting operations and requiring a reboot to recover. Systems that rely on kprobes for debugging or monitoring and have the specific kernel configuration enabled are particularly at risk.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to register a kprobe on the __rcu_irq_enter_check_tick() function, which causes a kernel stack overflow. The following commands can be used to reproduce the issue and thus detect the vulnerability: # cd /sys/kernel/tracing/ # echo 'p:mp1 __rcu_irq_enter_check_tick' >> kprobe_events # echo 1 > events/kprobes/enable If these commands cause a kernel stack overflow or kernel panic, the system is vulnerable.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, avoid registering kprobes on the __rcu_irq_enter_check_tick() function. The fix involves adding __rcu_irq_enter_check_tick() to the kprobes blacklist using NOKPROBE_SYMBOL(), preventing kprobes from being registered on this function. Applying the kernel patch or updating to a kernel version that includes this fix will mitigate the issue.