CVE-2023-5717

What it actually does

Heap out-of-bounds write in perf_read_group() triggered when an event's sibling_list is smaller than its child's sibling_list, allowing writes to memory locations outside the allocated buffer.

Why it matters to the business

Local attackers on affected Linux systems can gain full root privileges, enabling complete system compromise, data theft, or persistence; the issue affects a wide range of kernels but carries low immediate exploitation risk based on current scores and lack of known campaigns.

How an attack unfolds

An attacker with local user access creates a set of performance events whose sibling lists are deliberately sized to cause a mismatch, then invokes perf_read_group() to trigger the out-of-bounds write and overwrite kernel structures for privilege escalation.

How to fix it

Upgrade the Linux kernel past commit 32671e3799ca2e4590773fd0e63aaa4229e50c06; the GIT repository is fixed in bfe01a5ba2490f299e1d2d5508cbbbadd897bbe9.

How to confirm the fix worked

Verify the running kernel contains commit 32671e3799ca2e4590773fd0e63aaa4229e50c06 or later by inspecting /proc/version or the kernel source tree; test that perf_read_group() no longer permits out-of-bounds writes under sibling-list mismatch conditions.

Typical attack path

1. Obtain local unprivileged shell access on a vulnerable Linux host
2. Craft perf events with mismatched sibling_list sizes via the perf_event_open syscall
3. Trigger perf_read_group() to induce the heap out-of-bounds write
4. Overwrite kernel memory to escalate privileges to root
5. Execute arbitrary code or install persistence mechanisms

How to detect it

Review kernel logs for perf-related oops or warnings involving sibling_list or perf_read_group; inspect process creation and perf_event_open calls from untrusted users for anomalous patterns.

What your security team should do

• Apply the kernel patch or upgrade to a fixed version immediately on all exposed systems
• Monitor for new public exploits given the local attack surface
• Restrict untrusted local users from using the perf subsystem via sysctl or capabilities where feasible