CVE-2023-53167
📋 TL;DR
A null pointer dereference vulnerability in the Linux kernel's tracing subsystem allows local users to cause a kernel panic by performing an lseek operation on the /sys/kernel/tracing/error_log file opened with write-only permissions. This affects Linux systems with tracefs enabled, requiring local access and root privileges for exploitation.
💻 Affected Systems
- Linux Kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local denial of service causing kernel panic and system crash, requiring physical or remote console access to reboot.
Likely Case
Limited impact due to requirement for root privileges; potential for local DoS in multi-user systems where root users could crash the system.
If Mitigated
Minimal impact with proper privilege separation and monitoring of root user activities.
🎯 Exploit Status
Exploitation requires root privileges and specific sequence: open error_log with write-only permissions, then perform lseek operation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions containing commits: 02b0095e2fbbc060560c1065f86a211d91e27b26, 1e1c9aa9288a46c342f0f2c5c0b1c0876b9b0276, 3b5d9b7b875968a8a8c99dac45cb85b705c44802, 7060e5aac6dc195124c106f49106d653a416323a, or 93114cbc7cb169f6f26eeaed5286b91bb86b463b
Vendor Advisory: https://git.kernel.org/stable/c/02b0095e2fbbc060560c1065f86a211d91e27b26
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from your distribution's repositories. 2. Reboot system to load new kernel. 3. Verify kernel version after reboot.
🔧 Temporary Workarounds
Restrict tracefs access
allLimit access to tracefs directory to prevent unauthorized users from accessing error_log node.
chmod 700 /sys/kernel/tracing
chown root:root /sys/kernel/tracing
Disable tracefs if not needed
allRemove tracefs mount if tracing functionality is not required.
umount /sys/kernel/tracing
🧯 If You Can't Patch
- Implement strict root access controls and monitoring
- Disable unnecessary tracing features via kernel boot parameters
🔍 How to Verify
Check if Vulnerable:
Check if /sys/kernel/tracing/error_log exists and current kernel version matches affected range.Check Version:
uname -rVerify Fix Applied:
Verify kernel version includes one of the fix commits or is newer than patched versions.📡 Detection & Monitoring
Log Indicators:
- Kernel panic messages referencing 'tracing_err_log_open' or 'seq_lseek'
- NULL pointer dereference at address 0000000000000038 in kernel logs
Network Indicators:
- None - local exploitation only
SIEM Query:
source="kernel" AND ("tracing_err_log_open" OR "seq_lseek" OR "NULL pointer dereference")🔗 References
- https://git.kernel.org/stable/c/02b0095e2fbbc060560c1065f86a211d91e27b26
- https://git.kernel.org/stable/c/1e1c9aa9288a46c342f0f2c5c0b1c0876b9b0276
- https://git.kernel.org/stable/c/3b5d9b7b875968a8a8c99dac45cb85b705c44802
- https://git.kernel.org/stable/c/7060e5aac6dc195124c106f49106d653a416323a
- https://git.kernel.org/stable/c/93114cbc7cb169f6f26eeaed5286b91bb86b463b
- https://git.kernel.org/stable/c/938d5b7a75e18264887387ddf9169db6d8aeef98
