CVE-2023-52835

What it actually does

The flaw permits perf to request an AUX trace area larger than the maximum order supported by the page allocator for the rb->aux_pages pointer array, causing kcalloc to attempt an oversized physically contiguous allocation that triggers a WARNING in __alloc_pages.

Why it matters to the business

Linux systems running perf with large AUX buffers may produce kernel warnings, fail mmap operations, or consume excessive resources during performance tracing, affecting monitoring and diagnostics workloads.

How an attack unfolds

An attacker invokes perf record or equivalent tooling with an oversized AUX area (for example 4 GB) to trigger the unbounded allocation in rb_alloc_aux; no remote code execution path exists and the supplied threat actor label does not apply to this kernel validation issue.

How to fix it

Update the Linux kernel to a version containing commit 8c504f615d7ed60ae035c51d0c789137ced6797f which adds an early -ENOMEM check when the requested AUX area size is out of bounds.

How to confirm the fix worked

Confirm the running kernel contains commit 8c504f615d7ed60ae035c51d0c789137ced6797f or later; attempt perf record with a 4 GB AUX area and verify the command fails cleanly with ENOMEM instead of triggering the page allocator warning.

Typical attack path

1. Invoke perf record or mmap with AUX size exceeding MAX_ORDER limit
2. Kernel executes rb_alloc_aux which calls kcalloc for the pointer array
3. Allocation request exceeds physically contiguous order, hitting __alloc_pages warning path

How to detect it

Search kernel logs for the exact WARNING string referencing __alloc_pages and rb_alloc_aux; inspect recent perf record invocations or mmap calls requesting multi-gigabyte AUX areas.

• WARNING: CPU:.*PID:.*at mm/page_alloc.c.*__alloc_pages
• rb_alloc_aux
• failed to mmap with 12 (Cannot allocate memory)

What your security team should do

• Apply the fixed kernel commit or distribution package containing 8c504f615d7ed60ae035c51d0c789137ced6797f on all affected systems
• Review any automated or scheduled perf tracing jobs that specify large AUX buffers and reduce their sizes where possible
• Monitor kernel logs for __alloc_pages warnings related to rb_alloc_aux