Executive brief
The Linux kernel's user_events tracing subsystem processes event data written by user applications. The vulnerability allows a user-space process to specify a negative write index, which bypasses array bounds checking and could lead to memory corruption or information disclosure. An attacker with local access can exploit this by crafting malicious write() syscalls to access kernel memory outside the intended event array.
Technical details
This is an array index validation vulnerability in the user_events tracing code (kernel/trace/trace_events_user.c). The vulnerable function user_events_write_core() reads a 4-byte write index from user-supplied data without validating that it is non-negative before using it to access a per-file array. A negative index can wrap around due to unsigned/signed conversion, causing out-of-bounds memory access. The attack vector is local (requires write() syscall access to the tracing file descriptor) and requires no elevated privileges. The fix adds a simple bounds check: if (idx < 0) return -EINVAL. Patches were applied in April/May 2023.
Affected products
- Linux Linux kernel All versions with user_events tracing support (v5.15+)
Timeline
- 2023-04-25: disclosed: Vulnerability reported by Doug Cook and fix authored by Beau Belgrave
- 2023-05-11: patched: Fix merged into Linux stable tree (commit cd98c93286a30cc4588dfd02453bec63c2f4acf4)