Executive brief
The Linux kernel's tracing subsystem contains a race condition in the synthetic events handler that can be triggered by multiple concurrent users writing to the /sys/kernel/tracing/synthetic_events file. An attacker with local write access can cause memory safety violations (double-free or use-after-free) leading to system crashes or potential privilege escalation.
Technical details
A race condition exists in the Linux kernel's tracing subsystem, specifically in the synthetic events handler (create_or_delete_synth_event function). The vulnerability arises from unsynchronized access to the "last_cmd" variable when multiple processes concurrently manipulate the synthetic_events sysfs node. Two distinct exploitation paths exist: (1) double-free when one process frees last_cmd while another process is attempting to kstrdup it, and (2) use-after-free when one process frees last_cmd while another is attempting to read it via tracing_log_err. The attack requires local write access to /sys/kernel/tracing/synthetic_events. The fix adds a "lastcmd_mutex" to serialize access to the last_cmd variable, preventing concurrent manipulation.
Affected products
- Linux Linux kernel Multiple versions prior to patch (CVE-2023-53478)
Timeline
- 2025-10-01: disclosed: CVE-2023-53478 published
- patched: Fix includes addition of lastcmd_mutex to synchronize last_cmd access