CVE-2023-53024
published 2025-03-27CVE-2023-53024: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation To mitigate…
PriorityP432high7.1CVSS 3.1
AVLACLPRLUINSUCHINAH
EPSS
0.19%
8.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to
insufficient speculative store bypass mitigation") inserts lfence
instructions after 1) initializing a stack slot and 2) spilling a
pointer to the stack.
However, this does not cover cases where a stack slot is first
initialized with a pointer (subject to sanitization) but then
overwritten with a scalar (not subject to sanitization because
the slot was already initialized). In this case, the second write
may be subject to speculative store bypass (SSB) creating a
speculative pointer-as-scalar type confusion. This allows the
program to subsequently leak the numerical pointer value using,
for example, a branch-based cache side channel.
To fix this, also sanitize scalars if they write a stack slot
that previously contained a pointer. Assuming that pointer-spills
are only generated by LLVM on register-pressure, the performance
impact on most real-world BPF programs should be small.
The following unprivileged BPF bytecode drafts a minimal exploit
and the mitigation:
[...]
// r6 = 0 or 1 (skalar, unknown user input)
// r7 = accessible ptr for side channel
// r10 = frame pointer (fp), to be leaked
//
r9 = r10 # fp alias to encourage ssb
*(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked
// lfence added here because of pointer spill to stack.
//
// Ommitted: Dummy bpf_ringbuf_output() here to train alias predictor
// for no r9-r10 dependency.
//
*(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr
// 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID,
// store may be subject to SSB
//
// fix: also add an lfence when the slot contained a ptr
//
r8 = *(u64 *)(r9 - 8)
// r8 = architecturally a scalar, speculatively a ptr
//
// leak ptr using branch-based cache side channel:
r8 &= 1 // choose bit to leak
if r8 == 0 goto SLOW // no mispredic
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.11-1 (bookworm) | linux 6.1.11-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 0e9280654aa482088ee6ef3deadef331f5ac5fb0 < da75dec7c6617bddad418159ffebcb133f008262 | da75dec7c6617bddad418159ffebcb133f008262 |
| linux | linux | >= 2039f26f3aca5b0e419b98f65dd36481337b86ee < 01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528 | 01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528 |
| linux | linux | >= 2039f26f3aca5b0e419b98f65dd36481337b86ee < b0c89ef025562161242a7c19b213bd6b272e93df | b0c89ef025562161242a7c19b213bd6b272e93df |
| linux | linux | >= 2039f26f3aca5b0e419b98f65dd36481337b86ee < e4f4db47794c9f474b184ee1418f42e6a07412b6 | e4f4db47794c9f474b184ee1418f42e6a07412b6 |
| linux | linux | >= 4.19.207 < 4.19.272 | 4.19.272 |
| linux | linux | >= 5.10.56 < 5.10.166 | 5.10.166 |
| linux | linux | >= 5.13.8 < 5.14 | 5.14 |
| linux | linux | >= 5.4.146 < 5.4.231 | 5.4.231 |
| linux | linux | >= 872968502114d68c21419cf7eb5ab97717e7b803 < aae109414a57ab4164218f36e2e4a17f027fcaaa | aae109414a57ab4164218f36e2e4a17f027fcaaa |
| linux | linux | >= f5893af2704eb763eb982f01d573f5b19f06b623 < 81b3374944d201872cfcf82730a7860f8e7c31dd | 81b3374944d201872cfcf82730a7860f8e7c31dd |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 4.19.207 < 4.19.272 | 4.19.272 |
| linux | linux_kernel | >= 5.10.56 < 5.10.166 | 5.10.166 |
| linux | linux_kernel | >= 5.13.8 < 5.14 | 5.14 |
| linux | linux_kernel | >= 5.14.1 < 5.15.91 | 5.15.91 |
| linux | linux_kernel | >= 5.16 < 6.1.9 | 6.1.9 |
| linux | linux_kernel | >= 5.4.146 < 5.4.231 | 5.4.231 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
osv7.1HIGH
vendor_debian7.1HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
vendor_redhat·2025-03-27·CVSS 7.1
CVE-2023-53024 [HIGH] kernel: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
kernel: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to
insufficient speculative store bypass mitigation") inserts lfence
instructions after 1) initializing a stack slot and 2) spilling a
pointer to the stack.
However, this does not cover cases where a stack slot is first
initialized with a pointer (subject to sanitization) but then
overwritten with a scalar (not subject to sanitization because
the slot was already initialized). In this case, the second write
may be subject to speculative store bypass (SSB) creating a
speculative pointer-as-scalar type c
Debian
CVE-2023-53024: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix po...
vendor_debian·2023·CVSS 7.1
CVE-2023-53024 [HIGH] CVE-2023-53024: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: Fix po...
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") inserts lfence instructions after 1) initializing a stack slot and 2) spilling a pointer to the stack. However, this does not cover cases where a stack slot is first initialized with a pointer (subject to sanitization) but then overwritten with a scalar (not subject to sanitization because the slot was already initialized). In this case, the second write may be subject to speculative store bypass (SSB) creating a speculative pointer-as-scalar type confusion. This allows the program to subsequently leak the numerical pointer value usin
GHSA
GHSA-mqh3-5x68-9v64: In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
To
ghsa_unreviewed·2025-03-27
CVE-2023-53024 [HIGH] GHSA-mqh3-5x68-9v64: In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
To
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to
insufficient speculative store bypass mitigation") inserts lfence
instructions after 1) initializing a stack slot and 2) spilling a
pointer to the stack.
However, this does not cover cases where a stack slot is first
initialized with a pointer (subject to sanitization) but then
overwritten with a scalar (not subject to sanitization because
the slot was already initialized). In this case, the second write
may be subject to speculative store bypass (SSB) creating a
speculative pointer-as-scalar type confusion. This allows the
program to subsequently leak the numerical pointer value u
OSV
CVE-2023-53024: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation To m
osv·2025-03-27·CVSS 7.1
CVE-2023-53024 [HIGH] CVE-2023-53024: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation To m
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") inserts lfence instructions after 1) initializing a stack slot and 2) spilling a pointer to the stack. However, this does not cover cases where a stack slot is first initialized with a pointer (subject to sanitization) but then overwritten with a scalar (not subject to sanitization because the slot was already initialized). In this case, the second write may be subject to speculative store bypass (SSB) creating a speculative pointer-as-scalar type confusion. This allows the program to subsequently leak the numerical pointer value usin
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528https://git.kernel.org/stable/c/81b3374944d201872cfcf82730a7860f8e7c31ddhttps://git.kernel.org/stable/c/aae109414a57ab4164218f36e2e4a17f027fcaaahttps://git.kernel.org/stable/c/b0c89ef025562161242a7c19b213bd6b272e93dfhttps://git.kernel.org/stable/c/da75dec7c6617bddad418159ffebcb133f008262https://git.kernel.org/stable/c/e4f4db47794c9f474b184ee1418f42e6a07412b6
2025-03-27
Published