CVE-2023-52879: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52879 is a vulnerability in the Linux kernel's tracing subsystem that was discovered and disclosed in May 2024. The vulnerability affects multiple versions of the Linux kernel, including versions 5.4.258 through 5.4.262, 5.10.198 through 5.10.202, 5.15.134 through 5.15.140, 6.1.55 through 6.1.64, 6.5.5 through 6.5.13, and 6.6 through 6.6.1. This issue involves a use-after-free bug in the kernel's tracing functionality (NVD).

The vulnerability occurs when a kprobe event creates a trace_event_file descriptor that represents the file in tracefs to the event. When a kprobe event is deleted while a file descriptor is still open, the event file descriptor is freed but can still be referenced when the user closes or writes to the file descriptor, leading to a use-after-free condition. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

When exploited, this vulnerability can cause a kernel crash through a NULL pointer dereference, potentially leading to a denial of service condition. The impact is limited to availability, with no direct impact on confidentiality or integrity of the system (NVD).

The vulnerability can be triggered through a specific sequence of operations involving the tracefs system: changing to the tracing directory, creating a kprobe event, opening a file descriptor on the event's enable file, deleting the kprobe event, and then closing the file descriptor. This requires local access to the system with sufficient privileges to access the tracing subsystem (Kernel Patch).

The vulnerability has been patched by adding a reference counter to the event file descriptor and introducing a new 'FREED' flag. The fix ensures that the file descriptor is not freed until all references are released, and the FREED flag prevents modifications to the event even if references still exist. The patch has been incorporated into various kernel versions (Kernel Patch).