CVE-2023-52920
published 2024-11-05CVE-2023-52920: In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from stack in precision tracking Use…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.25%
16.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
bpf: support non-r10 register spill/fill to/from stack in precision tracking
Use instruction (jump) history to record instructions that performed
register spill/fill to/from stack, regardless if this was done through
read-only r10 register, or any other register after copying r10 into it
*and* potentially adjusting offset.
To make this work reliably, we push extra per-instruction flags into
instruction history, encoding stack slot index (spi) and stack frame
number in extra 10 bit flags we take away from prev_idx in instruction
history. We don't touch idx field for maximum performance, as it's
checked most frequently during backtracking.
This change removes basically the last remaining practical limitation of
precision backtracking logic in BPF verifier. It fixes known
deficiencies, but also opens up new opportunities to reduce number of
verified states, explored in the subsequent patches.
There are only three differences in selftests' BPF object files
according to veristat, all in the positive direction (less states).
File Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF)
-------------------------------------- ------------- --------- --------- ------------- ---------- ---------- -------------
test_cls_redirect_dynptr.bpf.linked3.o cls_redirect 2987 2864 -123 (-4.12%) 240 231 -9 (-3.75%)
xdp_synproxy_kern.bpf.linked3.o syncookie_tc 82848 82661 -187 (-0.23%) 5107 5073 -34 (-0.67%)
xdp_synproxy_kern.bpf.linked3.o syncookie_xdp 85116 84964 -152 (-0.18%) 5162 5130 -32 (-0.62%)
Note, I avoided renaming jmp_history to more generic insn_hist to
minimize number of lines changed and potential merge conflicts between
bpf and bpf-next trees.
Notice also cur_hist_entry pointer reset to NULL at the beginning of
instruction verification loop. This pointer avoids the problem of
relying on last jump history entry's insn_idx to determine whether we
already have entry for current in
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.8.9-1 (forky) | linux 6.8.9-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= b5dc0163d8fd78e64a7e21f309cf932fda34353e < ecc2aeeaa08a355d84d3ca9c3d2512399a194f29 | ecc2aeeaa08a355d84d3ca9c3d2512399a194f29 |
| linux | linux | >= b5dc0163d8fd78e64a7e21f309cf932fda34353e < 199f0452873741fa4b8d4d88958e929030b2f92b | 199f0452873741fa4b8d4d88958e929030b2f92b |
| linux | linux | >= b5dc0163d8fd78e64a7e21f309cf932fda34353e < e4da60feca4d35e1a9b03dc0affa3354f9ff45e4 | e4da60feca4d35e1a9b03dc0affa3354f9ff45e4 |
| linux | linux | >= b5dc0163d8fd78e64a7e21f309cf932fda34353e < 41f6f64e6999a837048b1bd13a2f8742964eca6b | 41f6f64e6999a837048b1bd13a2f8742964eca6b |
| linux | linux_kernel | < 6.8 | 6.8 |
| linux | linux_kernel | >= 0 < 6.8.9-1 | 6.8.9-1 |
| linux | linux_kernel | >= 0 < 6.8.9-1 | 6.8.9-1 |
| msrc | azl3_kernel_6.6.64.2-9_on_azure_linux_3.0 | — | — |
| msrc | azl3_kernel_6.6.92.2-1_on_azure_linux_3.0 | — | — |
| msrc | cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_msrc5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-52920: In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from stack in precision tracking Use i
osv·2024-11-05·CVSS 5.5
CVE-2023-52920 [MEDIUM] CVE-2023-52920: In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from stack in precision tracking Use i
In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from stack in precision tracking Use instruction (jump) history to record instructions that performed register spill/fill to/from stack, regardless if this was done through read-only r10 register, or any other register after copying r10 into it *and* potentially adjusting offset. To make this work reliably, we push extra per-instruction flags into instruction history, encoding stack slot index (spi) and stack frame number in extra 10 bit flags we take away from prev_idx in instruction history. We don't touch idx field for maximum performance, as it's checked most frequently during backtracking. This change removes basically the last remaining practical limitation of precision bac
GHSA
GHSA-79p2-24v8-gp9v: In the Linux kernel, the following vulnerability has been resolved:
bpf: support non-r10 register spill/fill to/from stack in precision tracking
Use
ghsa_unreviewed·2024-11-05
CVE-2023-52920 [MEDIUM] CWE-476 GHSA-79p2-24v8-gp9v: In the Linux kernel, the following vulnerability has been resolved:
bpf: support non-r10 register spill/fill to/from stack in precision tracking
Use
In the Linux kernel, the following vulnerability has been resolved:
bpf: support non-r10 register spill/fill to/from stack in precision tracking
Use instruction (jump) history to record instructions that performed
register spill/fill to/from stack, regardless if this was done through
read-only r10 register, or any other register after copying r10 into it
*and* potentially adjusting offset.
To make this work reliably, we push extra per-instruction flags into
instruction history, encoding stack slot index (spi) and stack frame
number in extra 10 bit flags we take away from prev_idx in instruction
history. We don't touch idx field for maximum performance, as it's
checked most frequently during backtracking.
This change removes basically the last remaining practical limitation of
precision
Microsoft
bpf: support non-r10 register spill/fill to/from stack in precision tracking
vendor_msrc·2024-11-12·CVSS 5.5
CVE-2023-52920 [MEDIUM] CWE-476 bpf: support non-r10 register spill/fill to/from stack in precision tracking
bpf: support non-r10 register spill/fill to/from stack in precision tracking
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Ref
Red Hat
kernel: bpf: support non-r10 register spill/fill to/from stack in precision tracking
vendor_redhat·2024-11-05·CVSS 5.5
CVE-2023-52920 [MEDIUM] CWE-476 kernel: bpf: support non-r10 register spill/fill to/from stack in precision tracking
kernel: bpf: support non-r10 register spill/fill to/from stack in precision tracking
In the Linux kernel, the following vulnerability has been resolved:
bpf: support non-r10 register spill/fill to/from stack in precision tracking
Use instruction (jump) history to record instructions that performed
register spill/fill to/from stack, regardless if this was done through
read-only r10 register, or any other register after copying r10 into it
*and* potentially adjusting offset.
To make this work reliably, we push extra per-instruction flags into
instruction history, encoding stack slot index (spi) and stack frame
number in extra 10 bit flags we take away from prev_idx in instruction
history. We don't touch idx field for maximum performance, as it's
checked most frequently during backtracking.
Debian
CVE-2023-52920: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: suppor...
vendor_debian·2023·CVSS 5.5
CVE-2023-52920 [MEDIUM] CVE-2023-52920: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: suppor...
In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from stack in precision tracking Use instruction (jump) history to record instructions that performed register spill/fill to/from stack, regardless if this was done through read-only r10 register, or any other register after copying r10 into it *and* potentially adjusting offset. To make this work reliably, we push extra per-instruction flags into instruction history, encoding stack slot index (spi) and stack frame number in extra 10 bit flags we take away from prev_idx in instruction history. We don't touch idx field for maximum performance, as it's checked most frequently during backtracking. This change removes basically the last remaining practical limitation of precision bac
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-11-05
Published