CVE-2023-2235: Use-after-free in Linux kernel's Performance Events subsystem

Vulnerability summary

CVE-2023-2235 is a high (CVSS 7.8) Use After Free vulnerability in linux linux_kernel. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 16.4% of scored vulnerabilities.

Timeline

1. 01-05-2023
   PublishedVulnerability first disclosed.
2. 07-08-2026
   Last modifiedVulnerability information updated.

Description

A use-after-free vulnerability in the Linux Kernel Performance Events system can be exploited to achieve local privilege escalation. The perf_group_detach function did not check the event's siblings' attach_state before calling add_event_to_groups(), but remove_on_exec made it possible to call list_del_event() on before detaching from their group, making it possible to use a dangling pointer causing a use-after-free vulnerability. We recommend upgrading past commit fd0815f632c24878e325821943edccc7fde947a2.

• CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.