CVE-2023-52707 – A use-after-free vulnerability in the Linux ker... (How to Fix)

Q: What is the severity of CVE-2023-52707?

CVE-2023-52707 has a CVSS score of 7.8 (HIGH). A use-after-free vulnerability in the Linux kernel's PSI (Pressure Stall Information) subsystem allows local attackers to potentially crash the system or execute arbitrary code. The issue occurs when a non-root cgroup is removed while a thread is still polling on a pressure file within that cgroup, leading to access to freed memory. This affects Linux systems with cgroup v2 enabled and PSI monitoring active.

📋 TL;DR

A use-after-free vulnerability in the Linux kernel's PSI (Pressure Stall Information) subsystem allows local attackers to potentially crash the system or execute arbitrary code. The issue occurs when a non-root cgroup is removed while a thread is still polling on a pressure file within that cgroup, leading to access to freed memory. This affects Linux systems with cgroup v2 enabled and PSI monitoring active.

💻 Affected Systems

Products:

Linux Kernel

Versions: Versions before the fix commits (specific versions vary by distribution, but generally Linux kernels before the fixes in 6.2.0-rc6 and backported to stable branches)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ✅ No

Notes: Requires cgroup v2 with PSI (CONFIG_PSI) enabled and a non-root user able to create cgroups and poll pressure files. Many distributions enable PSI by default but restrict cgroup creation to privileged users.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local privilege escalation to kernel-level code execution, potentially leading to full system compromise.

🟠

Likely Case

Kernel panic or system crash causing denial of service.

🟢

If Mitigated

No impact if proper access controls prevent non-privileged users from creating cgroups or polling PSI files.

🌐 Internet-Facing: LOW - Requires local access to exploit.

🏢 Internal Only: MEDIUM - Local users or compromised services could exploit this to crash systems or potentially escalate privileges.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires local access and ability to create/manipulate cgroups. The vulnerability is in kernel memory management, making reliable exploitation challenging but possible.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in Linux kernel commits: 7caeb5457bd01ccba0df1d6f4872f20d28e50b38, c2dbe32d5db5c4ead121cf86dabd5ab691fb47fe, c6879a4dcefe92d870ab68cabaa9caeda4f2af5a, cca2b3feb70170ef6f0fbc4b4d91eea235a2b73a, ec9c7aa08819f976b2492fa63c41b5712d2924b5

Vendor Advisory: https://git.kernel.org/stable/c/7caeb5457bd01ccba0df1d6f4872f20d28e50b38

Restart Required: Yes

Instructions:

1. Update to a patched kernel version from your distribution vendor. 2. For Red Hat/CentOS: 'yum update kernel'. 3. For Ubuntu/Debian: 'apt update && apt upgrade linux-image-*'. 4. For custom kernels: Apply the relevant commit from kernel.org. 5. Reboot the system after kernel update.

🔧 Temporary Workarounds

Disable PSI subsystem

linux

Disable the Pressure Stall Information subsystem if not needed

Add 'psi=0' to kernel boot parameters in /etc/default/grub or bootloader config
Run: update-grub (or grub2-mkconfig) and reboot

Restrict cgroup creation

linux

Prevent non-root users from creating cgroups via cgroup delegation settings

Set 'cgroup.subtree_control' appropriately in parent cgroups
Use 'systemd-run' with appropriate permissions for service management

🧯 If You Can't Patch

Implement strict access controls to prevent non-privileged users from creating or modifying cgroups
Monitor for suspicious cgroup creation/deletion activity and system crashes

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if PSI is enabled: 'uname -r' and 'grep CONFIG_PSI /boot/config-$(uname -r)'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched: 'uname -r' should be after the fix versions for your distribution

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs mentioning 'KASAN: use-after-free'
System crashes with call traces involving ep_remove_wait_queue or psi_trigger_destroy
Unexpected cgroup deletion events

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND ("use-after-free" OR "KASAN" OR "ep_remove_wait_queue" OR "psi_trigger_destroy")

📊 Metadata

CVE ID: CVE-2023-52707

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: May 21, 2024

Last Updated: January 6, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-52707, you might also want to check these: