CVE-2023-52879

What it actually does

Use-after-free in trace_event_file handling within the Linux kernel tracing subsystem; deletion of a kprobe event frees the associated structure while open file descriptors retain references, allowing writes or closes to dereference freed memory and trigger NULL pointer crashes.

Why it matters to the business

Kernel crashes on systems performing dynamic tracing or kprobe operations can cause denial of service, unplanned reboots, and disruption to workloads relying on observability tools, increasing operational overhead especially on high-uptime servers.

How an attack unfolds

An attacker with local access to tracefs creates a kprobe event, opens its enable file descriptor, deletes the event (freeing the structure), then closes or writes to the still-open descriptor, triggering the use-after-free; the provided refcount and FREED flag fix prevents further modifications after removal.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.4.262 or apply the commit 961c4511c7578d6b8f39118be919016ec3db1c1e (and equivalent backports) from the stable git repository; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Verify the running kernel version is at or above a listed fixed release; attempt the original reproducer sequence in a test environment and confirm no NULL pointer dereference occurs in tracing_release_file_tr.

Typical attack path

1. Change to /sys/kernel/tracing directory
2. Create a kprobe event via kprobe_events
3. Open a file descriptor on the event's enable file
4. Delete the kprobe event, removing its tracefs files and freeing the event structure
5. Close or write to the open file descriptor referencing the freed structure

How to detect it

Inspect kernel logs for Oops entries referencing tracing_release_file_tr and NULL pointer dereferences during tracefs operations; correlate with processes interacting with kprobe_events or tracefs enable files around the crash time.

What your security team should do

• Apply the kernel update immediately on all affected systems given the local privilege for crash reproduction
• Restrict unprivileged access to tracefs and kprobe_events where possible until patched
• Monitor vendor advisories for distribution-specific backports and schedule reboots
• Test tracing workloads on patched kernels before broad deployment