CVE-2023-28772: Linux Kernel Buffer Overflow Vulnerability

CVE-2023-28772 Overview

CVE-2023-28772 is a buffer overflow vulnerability in the Linux kernel affecting versions before 5.13.3. The flaw resides in lib/seq_buf.c within the seq_buf_putmem_hex() function, which converts memory contents to a hexadecimal representation. The function incorrectly handled the relationship between input length and the output hex buffer size, allowing data to be written past the end of the stack buffer. The issue is categorized as a classic buffer overflow [CWE-120] and impacts the kernel's tracing and sequence buffer infrastructure. Exploitation requires local access with high privileges, but successful exploitation can compromise confidentiality, integrity, and availability of the affected system.

Critical Impact
A local attacker with elevated privileges can trigger a stack buffer overflow in the kernel seq_buf_putmem_hex() routine, potentially leading to kernel memory corruption and denial of service.

Affected Products

Linux Kernel versions prior to 5.13.3
Distributions shipping vulnerable kernel branches (pre-5.13.3)
NetApp products bundling affected kernel versions (per NTAP-20230427-0005)

Discovery Timeline

2023-03-23 - CVE-2023-28772 published to NVD
2025-05-05 - Last updated in NVD database

Technical Details for CVE-2023-28772

Vulnerability Analysis

The vulnerability exists in seq_buf_putmem_hex(), a helper used by the kernel sequence buffer subsystem to emit memory regions in hex form. The function processes input data in chunks and writes each byte as two hex characters into a local stack buffer named hex. The original implementation bounded each iteration by HEX_CHARS - 1, treating that constant as if it represented the input byte count. In reality, HEX_CHARS describes the output buffer size, so writing HEX_CHARS - 1 input bytes produces nearly double that many output characters. The mismatch causes the inner write loop to overflow the on-stack hex array.

Root Cause

The root cause is improper boundary calculation between input length and output character length. The fix introduces a new constant, MAX_MEMHEX_BYTES, that explicitly represents the maximum number of input bytes safely convertible into the hex buffer. A BUILD_BUG_ON assertion enforces that MAX_MEMHEX_BYTES * 2 does not exceed HEX_CHARS, preventing future regressions.

Attack Vector

Exploitation requires local access and high privileges, typically via kernel interfaces that invoke seq_buf_putmem_hex() such as tracing facilities. An attacker able to influence the length parameter passed into the function can corrupt adjacent stack memory, potentially overwriting saved registers or function pointers within the kernel context.

// Patch: lib/seq_buf.c - seq_buf_putmem_hex()
 	WARN_ON(s->size == 0);
 
+	BUILD_BUG_ON(MAX_MEMHEX_BYTES * 2 >= HEX_CHARS);
+
 	while (len) {
-		start_len = min(len, HEX_CHARS - 1);
+		start_len = min(len, MAX_MEMHEX_BYTES);
 #ifdef __BIG_ENDIAN
 		for (i = 0, j = 0; i < start_len; i++) {
 #else

Source: GitHub Commit d3b16034a24a

Detection Methods for CVE-2023-28772

Indicators of Compromise

Unexpected kernel oops or panic messages referencing seq_buf_putmem_hex or seq_buf.c in dmesg output
Stack protector (__stack_chk_fail) warnings originating from kernel sequence buffer code paths
Kernel tracing subsystem crashes triggered by unprivileged-to-privileged transition activity

Detection Strategies

Inventory running kernel versions across Linux hosts and flag any kernel earlier than 5.13.3
Monitor kernel logs for crashes or warnings tied to the tracing or seq_buf infrastructure
Correlate privileged process activity with kernel ring buffer anomalies that may indicate exploitation attempts

Monitoring Recommendations

Forward dmesg, journald, and /var/log/kern.log events to a centralized log platform for kernel crash analysis
Track uname -r output across the fleet to identify hosts still running pre-5.13.3 kernels
Alert on repeated privileged process invocations of /sys/kernel/debug/tracing interfaces from unusual accounts

How to Mitigate CVE-2023-28772

Immediate Actions Required

Upgrade affected systems to Linux kernel 5.13.3 or later, or to a distribution kernel that backports commit d3b16034a24a
Restrict access to kernel tracing interfaces under /sys/kernel/debug/tracing to trusted administrative accounts only
Audit privileged account usage on Linux hosts to limit the population of users who could trigger the overflow

Patch Information

The fix is committed upstream as d3b16034a24a112bb83aeb669ac5b9b01f744bb7 and is included in the Linux 5.13.3 stable release. Refer to the Linux Kernel ChangeLog 5.13.3 and the upstream commit by Torvalds. NetApp customers should review NetApp Security Advisory NTAP-20230427-0005 for product-specific remediation.

Workarounds

Disable or restrict access to kernel tracing features (CONFIG_TRACING) where they are not required
Apply mandatory access controls (SELinux, AppArmor) to limit which processes can interact with seq_buf consumers
Reduce the number of users granted CAP_SYS_ADMIN or root, since the attack requires high privileges

bash

# Verify kernel version and confirm patched build
uname -r

# Restrict access to kernel tracing interfaces
mount -o remount,mode=700 /sys/kernel/debug
chmod 700 /sys/kernel/debug/tracing

# Debian/Ubuntu upgrade example
sudo apt update && sudo apt install --only-upgrade linux-image-generic
sudo reboot