CVE-2023-53793

Vulnerability

Analysis

CVE-2023-53793 is a memory leak vulnerability in the Linux kernel's perf tool on x86 architecture. The bug resides in the perf_env__read_cpuid function in util/env.c, which allocates memory via strdup but fails to free it under certain conditions. This was identified by AddressSanitizer, showing a direct leak of 21 bytes per allocation [1].

The leak occurs during perf event configuration when the tool reads the CPUID string to determine the CPU vendor. The function perf_env__read_cpuid duplicates a string without proper deallocation, and this leaked memory accumulates when perf commands are executed repeatedly. The attack surface is limited to local users running the perf tool, as no network or privilege escalation is involved. Exploitation requires no special authentication beyond normal user access.

The primary impact is gradual memory exhaustion on systems running perf, potentially leading to denial of service for the perf tool itself or related processes. However, the leak is small (21 bytes per call) and would require a very large number of invocations to cause significant harm. The vulnerability is considered low severity.

Mitigation

The fix has been applied in the Linux kernel via commits that properly free the allocated memory after use [2]. Users should update their kernel to a patched version. No workarounds are available other than avoiding repeated use of perf in untrusted environments.