CVE-2023-52835
perf/core: Bail out early if the request AUX area is out of bound
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: perf/core: Bail out early if the request AUX area is out of bound When perf-record with a large AUX area, e.g 4GB, it fails with: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory) and it reveals a WARNING with __alloc_pages(): ------------[ cut here ]------------ WARNING: CPU: 44 PID: 17573 at mm/page_alloc.c:5568 __alloc_pages+0x1ec/0x248 Call trace: __alloc_pages+0x1ec/0x248 __kmalloc_large_node+0xc0/0x1f8 __kmalloc_node+0x134/0x1e8 rb_alloc_aux+0xe0/0x298 perf_mmap+0x440/0x660 mmap_region+0x308/0x8a8 do_mmap+0x3c0/0x528 vm_mmap_pgoff+0xf4/0x1b8 ksys_mmap_pgoff+0x18c/0x218 __arm64_sys_mmap+0x38/0x58 invoke_syscall+0x50/0x128 el0_svc_common.constprop.0+0x58/0x188 do_el0_svc+0x34/0x50 el0_svc+0x34/0x108 el0t_64_sync_handler+0xb8/0xc0 el0t_64_sync+0x1a4/0x1a8 'rb->aux_pages' allocated by kcalloc() is a pointer array which is used to maintains AUX trace pages. The allocated page for this array is physically contiguous (and virtually contiguous) with an order of 0..MAX_ORDER. If the size of pointer array crosses the limitation set by MAX_ORDER, it reveals a WARNING. So bail out early with -ENOMEM if the request AUX area is out of bound, e.g.: #perf record -C 0 -m ,4G -e arm_spe_0// -- sleep 1 failed to mmap with 12 (Cannot allocate memory)
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.25% · top 83% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Weakness
Affected products
- affected 45bfb2e50471abbbfd83d40d28c986078b0d24ff – < 8c504f615d7ed60ae035c51d0c789137ced6797f
- affected 45bfb2e50471abbbfd83d40d28c986078b0d24ff – < 788c0b3442ead737008934947730a6d1ff703734
- affected 45bfb2e50471abbbfd83d40d28c986078b0d24ff – < 1a2a4202c60fcdffbf04f259002ce9bff39edece
- affected 45bfb2e50471abbbfd83d40d28c986078b0d24ff – < fd0df3f8719201dbe61a4d39083d5aecd705399a
- affected 45bfb2e50471abbbfd83d40d28c986078b0d24ff – < 9ce4e87a8efd37c85766ec08b15e885cab08553a
- affected 45bfb2e50471abbbfd83d40d28c986078b0d24ff – < 2424410f94a94d91230ced094062d859714c984a
- affected 45bfb2e50471abbbfd83d40d28c986078b0d24ff – < 2e905e608e38cf7f8dcddcf8a6036e91a78444cb
- affected 45bfb2e50471abbbfd83d40d28c986078b0d24ff – < 54aee5f15b83437f23b2b2469bcf21bdd9823916
- affected 4.1
- unaffected < 4.1
- unaffected 4.19.300 – ≤ 4.19.*
- unaffected 5.4.262 – ≤ 5.4.*
- unaffected 5.10.202 – ≤ 5.10.*
- unaffected 5.15.140 – ≤ 5.15.*
- unaffected 6.1.64 – ≤ 6.1.*
- unaffected 6.5.13 – ≤ 6.5.*
- unaffected 6.6.3 – ≤ 6.6.*
- unaffected 6.7 – ≤ *
References (8)
- https://git.kernel.org/stable/c/8c504f615d7ed60ae035c51d0c789137ced6797f (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/788c0b3442ead737008934947730a6d1ff703734 (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/1a2a4202c60fcdffbf04f259002ce9bff39edece (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/fd0df3f8719201dbe61a4d39083d5aecd705399a (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/9ce4e87a8efd37c85766ec08b15e885cab08553a (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/2424410f94a94d91230ced094062d859714c984a (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/2e905e608e38cf7f8dcddcf8a6036e91a78444cb (opens in a new tab)x_transferred
- https://git.kernel.org/stable/c/54aee5f15b83437f23b2b2469bcf21bdd9823916 (opens in a new tab)x_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-52835)Record last updated .