Loading story…
CVE-2023-5717 is a moderate-severity out-of-bounds write flaw in the Linux kernel Performance Events (perf_events) subsystem. A low-privileged local attacker could trigger it by reading an inherited performance-event group whose sibling_list is smaller than its child group's list, causing writes outside the intended buffer. Successful exploitation could crash the system, execute code, or elevate privileges; the vulnerability carries a CVSS v3.1 score of 7.8.
The upstream fix adds a group_generation counter to track performance-event group membership changes, propagates that state to inherited groups, and rejects reads with -ECHILD when parent and child generation values or sibling counts differ. Red Hat released corrected kernel packages for affected Red Hat Enterprise Linux 8 and 9 systems and Red Hat Virtualization 4 for RHEL 8. Red Hat noted that the default kernel.perf_event_paranoid=2 setting prevents the vulnerable code path from being triggered.
Get the actors, campaigns, and ATT&CK mapping behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Red Hat released fixes for the standard RHEL 8 kernel and RHEL 8 kernel-rt packages through RHSA-2024:0897 and RHSA-2024:0881.
Red Hat issued RHSA-2024:0724 to fix the vulnerability in the RHEL 8.6 Extended Update Support kernel and Red Hat Virtualization 4 for RHEL 8.
Red Hat remediated CVE-2023-5717 in the RHEL 8.8 Extended Update Support kernel through RHSA-2024:0575.
Red Hat issued fixes for the RHEL 9.2 Extended Update Support kernel and kernel-rt packages through RHSA-2024:0448 and RHSA-2024:0439.
The upstream Linux kernel added generation and sibling-count consistency checks for inherited performance-event group reads, rejecting mismatched parent and child groups with -ECHILD. The patch addresses the race underlying CVE-2023-5717.
Red Hat issued RHSA-2024:1306 to fix CVE-2023-5717 in the RHEL 9.0 Extended Update Support kernel-rt package.
Red Hat remediated the vulnerability in the RHEL 9 kernel and RHEL 9.0 Extended Update Support kernel through RHSA-2024:1248 and RHSA-2024:1250.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**CVE-2023-2235** is an important-severity use-after-free flaw in the Linux kernel Performance Events subsystem. A low-privileged local user can concurrently invoke `perf_group_detach()` and `remove_on_exec`, causing unsafe event-group handling that can crash the system or potentially permit local privilege escalation. Red Hat rated the issue **CVSS 7.8** with high confidentiality, integrity, and availability impact. The upstream fix corrects `perf_group_detach()` so sibling events are re-added to the group red-black tree based on each sibling's `PERF_ATTACH_CONTEXT` state, rather than the detached event's group-node state. Red Hat shipped kernel fixes for affected RHEL 8 and RHEL 9 variants and related products between June and October 2023; RHEL 8.4 and RHEL 6 are not affected.
Aug 26, 2026
Red Hat released Important kernel security updates for RHEL 8, RHEL 8 Real Time, and RHEL 9 Extended Update Support/SAP channels, remediating 19 to 21 Linux-kernel vulnerabilities. The affected packages include standard RHEL 8 kernel `4.18.0-513.18.1.el8_9`, RHEL 8 Real Time kernel `4.18.0-513.18.1.rt7.320.el8_9`, and RHEL 9.0 EUS kernel `5.14.0-70.93.2.el9_0` across x86_64, aarch64, s390x, and ppc64le systems. The fixes include **CVE-2023-5717**, a heap out-of-bounds write in the Performance Events `perf_read_group()` path that can enable local privilege escalation, and **CVE-2023-46813**, in which faulty SEV-ES MMIO access validation and a race condition can give a local user arbitrary kernel-memory write capability. The advisories also address use-after-free, NULL-pointer dereference, out-of-bounds access, resource-exhaustion, and side-channel flaws in networking, storage, Bluetooth, HID, SMB, virtualization, and performance-monitoring components. Organizations should deploy the applicable kernel packages and reboot affected hosts to activate the fixes.
Aug 26, 2026
A vulnerability tracked as **CVE-2023-46813** affects the Linux kernel's handling of AMD Secure Encrypted Virtualization (SEV) guests. A low-privileged local user in an SEV virtual machine can use MMIO/string I/O exception-emulation paths to trigger a buffer overflow or null-pointer dereference, potentially causing a denial of service or escalating privileges. Red Hat rates the issue **CVSS 7.0** and categorizes it as improper privilege management (`CWE-269`). Linux fixed the flaw by adding validation in the x86 SEV exception-emulation code before string I/O reads and writes. The new `vc_insn_string_check()` rejects user-space I/O operations whose addresses point into kernel space and raises a user page fault instead. Red Hat issued fixes for affected RHEL 8 and RHEL 9 kernel variants and Red Hat Virtualization 4 on RHEL 8; it reported no generally suitable mitigation beyond applying the relevant updates.
Aug 26, 2026