In the Linux kernel, the following vulnerability has been resolved: perf/core: Bail out early if the request AUX area is out of bound When perf-record with a large AUX area, e.g 4GB, it fails with: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory) and it reveals a WARNING with __alloc_pages(): ------------[ cut here ]------------ WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248 Call trace: __alloc_pages+0x1ec/0x248 __kmalloc_large_node+0xc0/0x1f8 __kmalloc_node+0x134/0x1e8 rb_alloc_aux+0xe0/0x298 perf_mmap+0x440/0x660 mmap_region+0x308/0x8a8 do_mmap+0x3c0/0x528 vm_mmap_pgoff+0xf4/0x1b8 ksys_mmap_pgoff+0x18c/0x218 __arm64_sys_mmap+0x38/0x58 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x58/0x188 do_el0_svc+0x34/0x50 el0_svc+0x34/0x108 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x1a4/0x1a8 'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to maintains AUX trace pages. The allocated page for this array is physically contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the size of pointer array crosses the limitation set by MAX_ORDER, it reveals a WARNING. So bail out early with -ENOMEM if the request AUX area is out of bound, e.g.: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory)

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Redhat
  • Enterprise Linux

No data.

Package CPE Advisory Released Date
Red Hat Enterprise Linux 8
kernel-rt-0:4.18.0-553.8.1.rt7.349.el8_10 cpe:/a:redhat:enterprise_linux:8::nfv RHSA-2024:4352 2024-07-08T00:00:00Z
kernel-0:4.18.0-553.8.1.el8_10 cpe:/o:redhat:enterprise_linux:8 RHSA-2024:4211 2024-07-02T00:00:00Z
References
Link Providers
https://git.kernel.org/stable/c/1a2a4202c60fcdffbf04f259002ce9bff39edece cve-icon cve-icon
https://git.kernel.org/stable/c/2424410f94a94d91230ced094062d859714c984a cve-icon cve-icon
https://git.kernel.org/stable/c/2e905e608e38cf7f8dcddcf8a6036e91a78444cb cve-icon cve-icon
https://git.kernel.org/stable/c/54aee5f15b83437f23b2b2469bcf21bdd9823916 cve-icon cve-icon
https://git.kernel.org/stable/c/788c0b3442ead737008934947730a6d1ff703734 cve-icon cve-icon
https://git.kernel.org/stable/c/8c504f615d7ed60ae035c51d0c789137ced6797f cve-icon cve-icon
https://git.kernel.org/stable/c/9ce4e87a8efd37c85766ec08b15e885cab08553a cve-icon cve-icon
https://git.kernel.org/stable/c/fd0df3f8719201dbe61a4d39083d5aecd705399a cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024052109-CVE-2023-52835-80ee@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2023-52835 cve-icon
https://www.cve.org/CVERecord?id=CVE-2023-52835 cve-icon
History

Thu, 19 Dec 2024 09:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 12 Sep 2024 08:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-05-04T07:44:00.575Z

Reserved: 2024-05-21T15:19:24.252Z

Link: CVE-2023-52835

cve-icon Vulnrichment

Updated: 2024-08-02T23:11:36.062Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-05-21T16:15:21.023

Modified: 2024-11-21T08:40:41.303

Link: CVE-2023-52835

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-05-21T00:00:00Z

Links: CVE-2023-52835 - Bugzilla