CVE-2023-54171

Vulnerability

Description

In the Linux kernel, a memory leak vulnerability exists in the tracing subsystem when reading from the 'trace_pipe' file. The leak originates from 'iter->temp', which is allocated or relocated by trace_find_next_entry() during each read operation but is not freed until the file is closed. This oversight causes allocated memory to persist, accumulating over multiple read operations.

Exploitation

An unprivileged user with access to the 'trace_pipe' file can trigger the leak by repeatedly reading from it. No special privileges are required beyond the ability to open and read the file, which is typically accessible to users in the 'trace' group or with root privileges. The attack surface is local, as the file resides in the debugfs or tracefs filesystem.

Impact

Repeated exploitation leads to gradual memory depletion, potentially causing system instability or denial-of-service conditions. While not directly exploitable for privilege escalation or code execution, the leak can degrade system performance and availability.

Mitigation

The fix, which frees 'iter->temp' in tracing_release_pipe(), has been applied to the mainline kernel and backported to stable branches, as seen in commits [1][2]. Users are advised to update to the latest patched kernel version for their distribution.