Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2023-52920— bpf: support non-r10 register spill/fill to/from stack in precision tracking

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于bpf模块中，对非r10寄存器进行溢出/填充到堆栈的支持不足，导致精度跟踪逻辑的限制未能有效处理，影响了BPF验证器的性能。

CVSS 7.8 · High EPSS 0.25% · P16

Affected Version Matrix 10

VendorProduct Version RangeStatus
Linux Linux b5dc0163d8fd78e64a7e21f309cf932fda34353e< ecc2aeeaa08a355d84d3ca9c3d2512399a194f29 affected
b5dc0163d8fd78e64a7e21f309cf932fda34353e< 199f0452873741fa4b8d4d88958e929030b2f92b affected
b5dc0163d8fd78e64a7e21f309cf932fda34353e< e4da60feca4d35e1a9b03dc0affa3354f9ff45e4 affected
b5dc0163d8fd78e64a7e21f309cf932fda34353e< 41f6f64e6999a837048b1bd13a2f8742964eca6b affected
5.3 affected
< 5.3 unaffected
6.6.64≤ 6.6.* unaffected
6.6.70≤ 6.6.* unaffected
… +2 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2023-52920

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
bpf: support non-r10 register spill/fill to/from stack in precision tracking
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from stack in precision tracking Use instruction (jump) history to record instructions that performed register spill/fill to/from stack, regardless if this was done through read-only r10 register, or any other register after copying r10 into it *and* potentially adjusting offset. To make this work reliably, we push extra per-instruction flags into instruction history, encoding stack slot index (spi) and stack frame number in extra 10 bit flags we take away from prev_idx in instruction history. We don't touch idx field for maximum performance, as it's checked most frequently during backtracking. This change removes basically the last remaining practical limitation of precision backtracking logic in BPF verifier. It fixes known deficiencies, but also opens up new opportunities to reduce number of verified states, explored in the subsequent patches. There are only three differences in selftests' BPF object files according to veristat, all in the positive direction (less states). File Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF) -------------------------------------- ------------- --------- --------- ------------- ---------- ---------- ------------- test_cls_redirect_dynptr.bpf.linked3.o cls_redirect 2987 2864 -123 (-4.12%) 240 231 -9 (-3.75%) xdp_synproxy_kern.bpf.linked3.o syncookie_tc 82848 82661 -187 (-0.23%) 5107 5073 -34 (-0.67%) xdp_synproxy_kern.bpf.linked3.o syncookie_xdp 85116 84964 -152 (-0.18%) 5162 5130 -32 (-0.62%) Note, I avoided renaming jmp_history to more generic insn_hist to minimize number of lines changed and potential merge conflicts between bpf and bpf-next trees. Notice also cur_hist_entry pointer reset to NULL at the beginning of instruction verification loop. This pointer avoids the problem of relying on last jump history entry's insn_idx to determine whether we already have entry for current instruction or not. It can happen that we added jump history entry because current instruction is_jmp_point(), but also we need to add instruction flags for stack access. In this case, we don't want to entries, so we need to reuse last added entry, if it is present. Relying on insn_idx comparison has the same ambiguity problem as the one that was fixed recently in [0], so we avoid that. [0] https://patchwork.kernel.org/project/netdevbpf/patch/20231110002638.4168352-3-andrii@kernel.org/
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于bpf模块中，对非r10寄存器进行溢出/填充到堆栈的支持不足，导致精度跟踪逻辑的限制未能有效处理，影响了BPF验证器的性能。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux b5dc0163d8fd78e64a7e21f309cf932fda34353e ~ ecc2aeeaa08a355d84d3ca9c3d2512399a194f29 -
Linux Linux 5.3 -

II. Public POCs for CVE-2023-52920

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2023-52920

请登录查看更多情报信息。

Patches & Fixes for CVE-2023-52920 (4)

Same Patch Batch · Linux · 2024-11-05 · 50 CVEs total

CVE-2024-50106 9.8 CRITICAL nfsd: fix race between laundromat and free_stateid
CVE-2024-50113 8.8 HIGH firewire: core: fix invalid port index for parent device
CVE-2024-50115 8.4 HIGH KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory
CVE-2024-50125 8.0 HIGH Bluetooth: SCO: Fix UAF on sco_sock_timeout
CVE-2024-50124 8.0 HIGH Bluetooth: ISO: Fix UAF on iso_sock_timeout
CVE-2024-50132 7.8 HIGH tracing/probes: Fix MAX_TRACE_ARGS limit handling
CVE-2024-50101 7.8 HIGH iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices
CVE-2024-50090 7.8 HIGH drm/xe/oa: Fix overflow in oa batch buffer
CVE-2024-50114 7.8 HIGH KVM: arm64: Unregister redistributor for failed vCPU creation
CVE-2024-50127 7.8 HIGH net: sched: fix use-after-free in taprio_change()
CVE-2024-50126 7.8 HIGH net: sched: use RCU read-side critical section in taprio_dump()
CVE-2024-50128 7.8 HIGH net: wwan: fix global oob in wwan_rtnl_policy
CVE-2024-50130 7.8 HIGH netfilter: bpf: must hold reference on net namespace
CVE-2024-50091 7.8 HIGH dm vdo: don't refer to dedupe_context after releasing it
CVE-2024-50095 7.5 HIGH RDMA/mad: Improve handling of timed out WRs of mad agent
CVE-2024-50094 7.5 HIGH sfc: Don't invoke xdp_do_flush() from netpoll.
CVE-2024-50131 7.3 HIGH tracing: Consider the NULL character when validating the event length
CVE-2024-50117 7.3 HIGH drm/amd: Guard against bad data for ATIF ACPI method
CVE-2024-50096 7.3 HIGH nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error
CVE-2024-50099 7.3 HIGH arm64: probes: Remove broken LDR (literal) uprobe support

Showing top 20 of 50 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2023-52920

No comments yet

Leave a comment