CVE-2023-2235

What it actually does

A use-after-free vulnerability in the Linux Kernel Performance Events subsystem allows an attacker to dereference a dangling pointer in perf_group_detach after remove_on_exec calls list_del_event on sibling events without proper attach_state checks, enabling arbitrary code execution.

Why it matters to the business

Local attackers can escalate privileges to root on affected Linux systems, risking full system compromise, data theft, or service disruption; the issue has been public for years with stable but low exploitation likelihood and no ransomware usage.

How an attack unfolds

An attacker with local access creates performance events, configures siblings, invokes remove_on_exec to detach them prematurely, then triggers the dangling pointer in add_event_to_groups to corrupt kernel memory and execute code with elevated privileges.

How to fix it

Upgrade the Linux kernel past commit fd0815f632c24878e325821943edccc7fde947a2 in the mainline repository; apply the corresponding backported fix in your distribution's kernel package.

How to confirm the fix worked

Confirm the running kernel source or binary contains commit fd0815f632c24878e325821943edccc7fde947a2; test by attempting the event detachment sequence in a controlled environment and verifying no use-after-free occurs.

Typical attack path

1. Obtain local unprivileged access to a Linux system
2. Use perf_event_open to create grouped events and set remove_on_exec
3. Force list_del_event on siblings before group detachment
4. Leverage the resulting use-after-free for kernel memory corruption and privilege escalation

How to detect it

Review kernel logs for perf subsystem warnings or crashes involving group detachment; monitor for repeated perf_event_open calls followed by unexpected process behavior or privilege changes.

What your security team should do

• Prioritize kernel updates on all internet-facing and multi-user systems
• Limit unprivileged local access and perf_event_paranoid settings where feasible
• Audit systems for any custom perf monitoring tools that could trigger the flaw