linux-cve-announce - CVE-2023-53375: tracing: Free error logs of tracing instances

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2025091855-CVE-2023-53375-a29f@gregkh>
Date: Thu, 18 Sep 2025 15:34:20 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2023-53375: tracing: Free error logs of tracing instances

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tracing: Free error logs of tracing instances

When a tracing instance is removed, the error messages that hold errors
that occurred in the instance needs to be freed. The following reports a
memory leak:

 # cd /sys/kernel/tracing
 # mkdir instances/foo
 # echo 'hist:keys=x' > instances/foo/events/sched/sched_switch/trigger
 # cat instances/foo/error_log
 [  117.404795] hist:sched:sched_switch: error: Couldn't find field
   Command: hist:keys=x
                      ^
 # rmdir instances/foo

Then check for memory leaks:

 # echo scan > /sys/kernel/debug/kmemleak
 # cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff88810d8ec700 (size 192):
  comm "bash", pid 869, jiffies 4294950577 (age 215.752s)
  hex dump (first 32 bytes):
    60 dd 68 61 81 88 ff ff 60 dd 68 61 81 88 ff ff  `.ha....`.ha....
    a0 30 8c 83 ff ff ff ff 26 00 0a 00 00 00 00 00  .0......&.......
  backtrace:
    [<00000000dae26536>] kmalloc_trace+0x2a/0xa0
    [<00000000b2938940>] tracing_log_err+0x277/0x2e0
    [<000000004a0e1b07>] parse_atom+0x966/0xb40
    [<0000000023b24337>] parse_expr+0x5f3/0xdb0
    [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560
    [<00000000293a9645>] trigger_process_regex+0x135/0x1a0
    [<000000005c22b4f2>] event_trigger_write+0x87/0xf0
    [<000000002cadc509>] vfs_write+0x162/0x670
    [<0000000059c3b9be>] ksys_write+0xca/0x170
    [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0
    [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc
unreferenced object 0xffff888170c35a00 (size 32):
  comm "bash", pid 869, jiffies 4294950577 (age 215.752s)
  hex dump (first 32 bytes):
    0a 20 20 43 6f 6d 6d 61 6e 64 3a 20 68 69 73 74  .  Command: hist
    3a 6b 65 79 73 3d 78 0a 00 00 00 00 00 00 00 00  :keys=x.........
  backtrace:
    [<000000006a747de5>] __kmalloc+0x4d/0x160
    [<000000000039df5f>] tracing_log_err+0x29b/0x2e0
    [<000000004a0e1b07>] parse_atom+0x966/0xb40
    [<0000000023b24337>] parse_expr+0x5f3/0xdb0
    [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560
    [<00000000293a9645>] trigger_process_regex+0x135/0x1a0
    [<000000005c22b4f2>] event_trigger_write+0x87/0xf0
    [<000000002cadc509>] vfs_write+0x162/0x670
    [<0000000059c3b9be>] ksys_write+0xca/0x170
    [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0
    [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc

The problem is that the error log needs to be freed when the instance is
removed.

The Linux kernel CVE team has assigned CVE-2023-53375 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.2 with commit 2f754e771b1a6feba670782e82c45555984ac43b and fixed in 5.4.241 with commit 987f599fc556a4e64c405d8dde32c70311e8c278
	Issue introduced in 5.2 with commit 2f754e771b1a6feba670782e82c45555984ac43b and fixed in 5.10.178 with commit 6e36373aa5ffa8e00fe7c71b3209f6f17081e552
	Issue introduced in 5.2 with commit 2f754e771b1a6feba670782e82c45555984ac43b and fixed in 5.15.107 with commit 33d5d4e67a0e13c3ca6257fa67bf6503bc000878
	Issue introduced in 5.2 with commit 2f754e771b1a6feba670782e82c45555984ac43b and fixed in 6.1.24 with commit c0cf0f55be043ef67c38f492aa37ed1986d2f6b6
	Issue introduced in 5.2 with commit 2f754e771b1a6feba670782e82c45555984ac43b and fixed in 6.2.11 with commit 46771c34d6721abfd9e7903eaed2201051eebec6
	Issue introduced in 5.2 with commit 2f754e771b1a6feba670782e82c45555984ac43b and fixed in 6.3 with commit 3357c6e429643231e60447b52ffbb7ac895aca22

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53375
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/trace/trace.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/987f599fc556a4e64c405d8dde32c70311e8c278
	https://git.kernel.org/stable/c/6e36373aa5ffa8e00fe7c71b3209f6f17081e552
	https://git.kernel.org/stable/c/33d5d4e67a0e13c3ca6257fa67bf6503bc000878
	https://git.kernel.org/stable/c/c0cf0f55be043ef67c38f492aa37ed1986d2f6b6
	https://git.kernel.org/stable/c/46771c34d6721abfd9e7903eaed2201051eebec6
	https://git.kernel.org/stable/c/3357c6e429643231e60447b52ffbb7ac895aca22