CyberSecBulletin
CVE-2023-53668NVD status: Analyzed

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2023-53668 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 0a29dae5786d263016a9aceb1e56bf3fd4cc6fa0, a55e8a3596048c2f7b574049aeb1885b5abba1cc, e84829522fc72bb43556b31575731de0440ac0dd as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.15% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 0a29dae5786d263016a9aceb1e56bf3fd4cc6fa0 or a55e8a3596048c2f7b574049aeb1885b5abba1cc or e84829522fc72bb43556b31575731de0440ac0dd or 5e68f1f3a20fe9b6bde018e353269fbfa289609c, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.14.322 or 4.19.291 or 5.4.251 or 5.10.188, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxa5fb833172eca69136e9ee1ada778e404086ab8a up to, but not including, 0a29dae5786d263016a9aceb1e56bf3fd4cc6fa0; a5fb833172eca69136e9ee1ada778e404086ab8a up to, but not including, a55e8a3596048c2f7b574049aeb1885b5abba1cc; a5fb833172eca69136e9ee1ada778e404086ab8a up to, but not including, e84829522fc72bb43556b31575731de0440ac0dd; a5fb833172eca69136e9ee1ada778e404086ab8a up to, but not including, 5e68f1f3a20fe9b6bde018e353269fbfa289609c; a5fb833172eca69136e9ee1ada778e404086ab8a up to, but not including, bb14a93bccc92766b1d9302c6bcbea17d4bce306; a5fb833172eca69136e9ee1ada778e404086ab8a up to, but not including, 8b0b63fdac6b70a45614e7d4b30e5bbb93deb007; a5fb833172eca69136e9ee1ada778e404086ab8a up to, but not including, 27bdd93e44cc28dd9b94893fae146b83d4f5b31e; a5fb833172eca69136e9ee1ada778e404086ab8a up to, but not including, 7e42907f3a7b4ce3a2d1757f6d78336984daf8f5; and 1 more ranges0a29dae5786d263016a9aceb1e56bf3fd4cc6fa0, a55e8a3596048c2f7b574049aeb1885b5abba1cc, e84829522fc72bb43556b31575731de0440ac0dd, 5e68f1f3a20fe9b6bde018e353269fbfa289609c, bb14a93bccc92766b1d9302c6bcbea17d4bce306, 8b0b63fdac6b70a45614e7d4b30e5bbb93deb007
LinuxLinux Kernel3.6 up to, but not including, 4.14.322; 4.15 up to, but not including, 4.19.291; 4.20 up to, but not including, 5.4.251; 5.5 up to, but not including, 5.10.188; 5.11 up to, but not including, 5.15.121; 5.16 up to, but not including, 6.1.40; 6.2 up to, but not including, 6.4.5; 6.54.14.322, 4.19.291, 5.4.251, 5.10.188, 5.15.121, 6.1.40

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix deadloop issue on reading trace_pipe Soft lockup occurs when reading file 'trace_pipe': watchdog: BUG: soft lockup - CPU#6 stuck for 22s! [cat:4488] [...] RIP: 0010:ring_buffer_empty_cpu+0xed/0x170 RSP: 0018:ffff88810dd6fc48 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000246 RCX: ffffffff93d1aaeb RDX: ffff88810a280040 RSI: 0000000000000008 RDI: ffff88811164b218 RBP: ffff88811164b218 R08: 0000000000000000 R09: ffff88815156600f R10: ffffed102a2acc01 R11: 0000000000000001 R12: 0000000051651901 R13: 0000000000000000 R14: ffff888115e49500 R15: 0000000000000000 [...] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8d853c2000 CR3: 000000010dcd8000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __find_next_entry+0x1a8/0x4b0 ? peek_next_entry+0x250/0x250 ? down_write+0xa5/0x120 ? down_write_killable+0x130/0x130 trace_find_next_entry_inc+0x3b/0x1d0 tracing_read_pipe+0x423/0xae0 ? tracing_splice_read_pipe+0xcb0/0xcb0 vfs_read+0x16b/0x490 ksys_read+0x105/0x210 ? __ia32_sys_pwrite64+0x200/0x200 ? switch_fpu_return+0x108/0x220 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x61/0xc6 Through the vmcore, I found it's because in tracing_read_pipe(), ring_buffer_empty_cpu() found some buffer is not empty but then it cannot read anything due to "rb_num_of_entries() == 0" always true, Then it infinitely loop the procedure due to user buffer not been filled, see following code path: tracing_read_pipe() { ... ... waitagain: tracing_wait_pipe() // 1. find non-empty buffer here trace_find_next_entry_inc() // 2. loop here try to find an entry __find_next_entry() ring_buffer_empty_cpu(); // 3. find non-empty buffer peek_next_entry() // 4. but peek always return NULL ring_buffer_peek() rb_buffer_peek() rb_get_reader_page() // 5. because rb_num_of_entries() == 0 always true here // then return NULL // 6. user buffer not been filled so goto 'waitgain' // and eventually leads to an deadloop in kernel!!! } By some analyzing, I found that when resetting ringbuffer, the 'entries' of its pages are not all cleared (see rb_reset_cpu()). Then when reducing the ringbuffer, and if some reduced pages exist dirty 'entries' data, they will be added into 'cpu_buffer->overrun' (see rb_remove_pages()), which cause wrong 'overrun' count and eventually cause the deadloop issue. To fix it, we need to clear every pages in rb_reset_cpu().

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.