CVE-2023-53478

None

CVSS

—

EPSS

0.1%

Published

Oct 1, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's event tracing feature can let multiple programs interfere with each other and crash the system when they try to create or remove custom events at the same time.

Exploitation: Local Privilege
Attacker needs: Local User
Complexity: Moderate
Impact: Privilege Gain
Component: OS kernel
Class: Race Condition
Remediation: Patch
Effort: Low
Patch risk: Low

What it actually does

Race condition in kernel tracing synthetic event handling allows concurrent asynchronous access to the last_cmd variable, resulting in use-after-free or double-free during kstrdup/kfree operations in create_or_delete_synth_event and trace_parse_run_command paths.

Why it matters to the business

Systems running affected Linux kernels may experience crashes, memory corruption, or denial of service when multiple processes concurrently manipulate synthetic_events tracing nodes; high prevalence in Linux environments increases exposure risk despite low exploit maturity.

How an attack unfolds

An attacker with write access to /sys/kernel/tracing/synthetic_events concurrently executes writes containing specific byte patterns from separate processes to trigger the race on last_cmd allocation and deallocation, leading to double-free or use-after-free that can be leveraged for kernel memory corruption.

How to fix it

Apply kernel patches adding lastcmd_mutex protection; upgrade to fixed versions including org/pub/scm/linux/kernel/git/stable/linux.git commit 9fe183f659a2704255e5d84f6ae308c234a113ec or chrony Debian packages 3.5.1-1 where applicable; disable unnecessary synthetic event tracing if patching is delayed.

How to confirm the fix worked

Verify kernel source contains lastcmd_mutex initialization and locking around last_cmd access in tracing/synthetic code; test by running concurrent synthetic_events writes under KASAN to confirm absence of double-free/use-after-free reports; check package versions against fixed lists.

Typical attack path

Identify systems with synthetic event tracing enabled via /sys/kernel/tracing/synthetic_events
Launch multiple concurrent writer processes issuing echo commands with crafted byte sequences to the tracing node
Trigger race condition between kstrdup allocation in one process and kfree in another
Exploit resulting double-free or use-after-free for memory corruption or crash

How to detect it

Search kernel logs for KASAN reports mentioning double-free or use-after-free in kfree, create_or_delete_synth_event, trace_parse_run_command, or synth_events_write; inspect for repeated writes to /sys/kernel/tracing/synthetic_events from multiple processes; review audit logs for concurrent tracing configuration changes.

BUG: KASAN: double-free in kfree
BUG: KASAN: use-after-free in strlen
create_or_delete_synth_event
synth_events_write
/sys/kernel/tracing/synthetic_events

What your security team should do

Prioritize kernel updates on all affected Linux systems within standard patch windows given low EPSS and no KEV listing
Audit workloads using synthetic event tracing for concurrent access patterns
Monitor for kernel oops or KASAN reports related to tracing/synthetic paths
Restrict unprivileged write access to tracing debugfs/sysfs nodes where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: tracing/synthetic: Fix races on freeing last_cmd Currently, the "last_cmd" variable can be accessed by multiple processes asynchronously when multiple users manipulate synthetic_events node at the same time, it could lead to use-after-free or double-free. This patch add "lastcmd_mutex" to prevent "last_cmd" from being accessed asynchronously. ================================================================ It's easy to reproduce in the KASAN environment by running the two scripts below in different shells. script 1: while : do echo -n -e '\x88' > /sys/kernel/tracing/synthetic_events done script 2: while : do echo -n -e '\xb0' > /sys/kernel/tracing/synthetic_events done ================================================================ double-free scenario: process A process B ------------------- --------------- 1.kstrdup last_cmd 2.free last_cmd 3.free last_cmd(double-free) ================================================================ use-after-free scenario: process A process B ------------------- --------------- 1.kstrdup last_cmd 2.free last_cmd 3.tracing_log_err(use-after-free) ================================================================ Appendix 1. KASAN report double-free: BUG: KASAN: double-free in kfree+0xdc/0x1d4 Free of addr ***** by task sh/4879 Call trace: ... kfree+0xdc/0x1d4 create_or_delete_synth_event+0x60/0x1e8 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... Allocated by task 4879: ... kstrdup+0x5c/0x98 create_or_delete_synth_event+0x6c/0x1e8 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... Freed by task 5464: ... kfree+0xdc/0x1d4 create_or_delete_synth_event+0x60/0x1e8 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... ================================================================ Appendix 2. KASAN report use-after-free: BUG: KASAN: use-after-free in strlen+0x5c/0x7c Read of size 1 at addr ***** by task sh/5483 sh: CPU: 7 PID: 5483 Comm: sh ... __asan_report_load1_noabort+0x34/0x44 strlen+0x5c/0x7c tracing_log_err+0x60/0x444 create_or_delete_synth_event+0xc4/0x204 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... Allocated by task 5483: ... kstrdup+0x5c/0x98 create_or_delete_synth_event+0x80/0x204 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ... Freed by task 5480: ... kfree+0xdc/0x1d4 create_or_delete_synth_event+0x74/0x204 trace_parse_run_command+0x2bc/0x4b8 synth_events_write+0x20/0x30 vfs_write+0x200/0x830 ...

Affected packages

Ecosystem	Package	Introduced	Fixed
Linux	Kernel	5.18.0	6.1.24