CVE-2023-6931: Out-of-bounds write in Linux kernel's Performance Events system component
A flaw was found in the Linux kernel. It is possible to overflow a perfevent's readsize, causing an out-of-bounds write in perfreadgroup(). The check meant to prevent such an overflow in perfeventvalidatesize() does not account for groups of events with mixed readformat values. The flaw can be triggered with events created with PERFFORMATGROUP or events added with PERFFORMATGROUP after some preconditions.
The bug was introduced around fa8c269353d5 ("perf/core: Invert perfreadgroup() loops"). Fixes: a723968c0ed3 ("perf: Fix u16 overflows").
Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=382c27f4ed28f803b1f1473ac2d8db0afc795a1b
Other sources
A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation.
A perfevent's readsize can overflow, leading to an heap out-of-bounds increment or write in perfreadgroup().
We recommend upgrading past commit 382c27f4ed28f803b1f1473ac2d8db0afc795a1b.
— MITRE
Linux Kernel could allow a local authenticated attacker to gain elevated privileges on the system, caused by a heap out-of-bounds write flaw in the Performance Events system component. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6931?
CVE-2023-6931 has been classified as a medium severity vulnerability affecting the Linux kernel.
How do I fix CVE-2023-6931?
To fix CVE-2023-6931, upgrade to a patched version of the Linux kernel that addresses this specific vulnerability.
What versions of the Linux kernel are affected by CVE-2023-6931?
CVE-2023-6931 affects Linux kernel versions from 4.3 up to, but not including, version 6.7.
Which distributions are impacted by CVE-2023-6931?
Distributions such as Debian 10.0 and IBM QRadar SIEM versions up to 7.5.0 UP8 IF01 are impacted by CVE-2023-6931.
What is the impact of CVE-2023-6931?
CVE-2023-6931 can lead to an out-of-bounds write in perf_read_group(), potentially allowing for unauthorized actions by an attacker.