CVE-2023-54145
published 2025-12-24CVE-2023-54145: In the Linux kernel, the following vulnerability has been resolved: bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log It's trivial for user to…
PriorityP424low3.3
EPSS
0.17%
6.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
It's trivial for user to trigger "verifier log line truncated" warning,
as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at
least two pieces of user-provided information that can be output through
this buffer, and both can be arbitrarily sized by user:
- BTF names;
- BTF.ext source code lines strings.
Verifier log buffer should be properly sized for typical verifier state
output. But it's sort-of expected that this buffer won't be long enough
in some circumstances. So let's drop the check. In any case code will
work correctly, at worst truncating a part of a single line output.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.112-1 (bookworm) | linux 6.1.112-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= a2a7d5701052542cd2260e7659b12443e0a74733 < 40c88c429a598006f91ad7a2b89856cd50b3a008 | 40c88c429a598006f91ad7a2b89856cd50b3a008 |
| linux | linux | >= a2a7d5701052542cd2260e7659b12443e0a74733 < 926a175026fed5d534f587ea4ec3ec49265cd3c5 | 926a175026fed5d534f587ea4ec3ec49265cd3c5 |
| linux | linux | >= a2a7d5701052542cd2260e7659b12443e0a74733 < cff36398bd4c7d322d424433db437f3c3391c491 | cff36398bd4c7d322d424433db437f3c3391c491 |
| linux | linux_kernel | >= 0 < 6.1.112-1 | 6.1.112-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 0 < 6.4.11-1 | 6.4.11-1 |
| linux | linux_kernel | >= 4.15.0 < 6.1.107 | 6.1.107 |
| linux | linux_kernel | >= 6.2.0 < 6.4.7 | 6.4.7 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2023-54145: In the Linux kernel, the following vulnerability has been resolved: bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log It's trivial for
osv·2025-12-24
CVE-2023-54145 CVE-2023-54145: In the Linux kernel, the following vulnerability has been resolved: bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log It's trivial for
In the Linux kernel, the following vulnerability has been resolved: bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log It's trivial for user to trigger "verifier log line truncated" warning, as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at least two pieces of user-provided information that can be output through this buffer, and both can be arbitrarily sized by user: - BTF names; - BTF.ext source code lines strings. Verifier log buffer should be properly sized for typical verifier state output. But it's sort-of expected that this buffer won't be long enough in some circumstances. So let's drop the check. In any case code will work correctly, at worst truncating a part of a single line output.
OSV
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
osv·2025-12-24
CVE-2023-54145 bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
In the Linux kernel, the following vulnerability has been resolved:
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
It's trivial for user to trigger "verifier log line truncated" warning,
as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at
least two pieces of user-provided information that can be output through
this buffer, and both can be arbitrarily sized by user:
- BTF names;
- BTF.ext source code lines strings.
Verifier log buffer should be properly sized for typical verifier state
output. But it's sort-of expected that this buffer won't be long enough
in some circumstances. So let's drop the check. In any case code will
work correctly, at worst truncating a part of a si
GHSA
GHSA-m575-6r3m-823p: In the Linux kernel, the following vulnerability has been resolved:
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
It's trivial f
ghsa_unreviewed·2025-12-24
CVE-2023-54145 GHSA-m575-6r3m-823p: In the Linux kernel, the following vulnerability has been resolved:
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
It's trivial f
In the Linux kernel, the following vulnerability has been resolved:
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
It's trivial for user to trigger "verifier log line truncated" warning,
as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at
least two pieces of user-provided information that can be output through
this buffer, and both can be arbitrarily sized by user:
- BTF names;
- BTF.ext source code lines strings.
Verifier log buffer should be properly sized for typical verifier state
output. But it's sort-of expected that this buffer won't be long enough
in some circumstances. So let's drop the check. In any case code will
work correctly, at worst truncating a part of a single line output.
Red Hat
kernel: Linux kernel: BPF verifier log truncation via crafted user input
vendor_redhat·2025-12-24·CVSS 3.3
CVE-2023-54145 [LOW] CWE-410 kernel: Linux kernel: BPF verifier log truncation via crafted user input
kernel: Linux kernel: BPF verifier log truncation via crafted user input
In the Linux kernel, the following vulnerability has been resolved:
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
It's trivial for user to trigger "verifier log line truncated" warning,
as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at
least two pieces of user-provided information that can be output through
this buffer, and both can be arbitrarily sized by user:
- BTF names;
- BTF.ext source code lines strings.
Verifier log buffer should be properly sized for typical verifier state
output. But it's sort-of expected that this buffer won't be long enough
in some circumstances. So let's drop the check. In any case code will
work correctly, at worst truncating a part of
Debian
CVE-2023-54145: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: drop u...
vendor_debian·2023
CVE-2023-54145 CVE-2023-54145: linux - In the Linux kernel, the following vulnerability has been resolved: bpf: drop u...
In the Linux kernel, the following vulnerability has been resolved: bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log It's trivial for user to trigger "verifier log line truncated" warning, as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at least two pieces of user-provided information that can be output through this buffer, and both can be arbitrarily sized by user: - BTF names; - BTF.ext source code lines strings. Verifier log buffer should be properly sized for typical verifier state output. But it's sort-of expected that this buffer won't be long enough in some circumstances. So let's drop the check. In any case code will work correctly, at worst truncating a part of a single line output.
Scope: local
bookworm: resolved (fixed in 6.1.112-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2023-54145 kernel: Linux kernel: BPF verifier log truncation via crafted user input
bugzilla·2025-12-24
CVE-2023-54145 [LOW] CVE-2023-54145 kernel: Linux kernel: BPF verifier log truncation via crafted user input
CVE-2023-54145 kernel: Linux kernel: BPF verifier log truncation via crafted user input
In the Linux kernel, the following vulnerability has been resolved:
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
It's trivial for user to trigger "verifier log line truncated" warning,
as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at
least two pieces of user-provided information that can be output through
this buffer, and both can be arbitrarily sized by user:
- BTF names;
- BTF.ext source code lines strings.
Verifier log buffer should be properly sized for typical verifier state
output. But it's sort-of expected that this buffer won't be long enough
in some circumstances. So let's drop the check. In any case code will
work correctly, at worst tru
Wiz
CVE-2023-54145 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz
CVE-2023-54145 CVE-2023-54145 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2023-54145 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
It's trivial for user to trigger "verifier log line truncated" warning,
as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at
least two pieces of user-provided information that can be output through
this buffer, and both can be arbitrarily sized by user:
BTF names;
BTF.ext source code lines strings.
Verifier log buffer should be properly sized for typical verifier state
output. But it's sort-of expected that this buffer won't be long enough
in some circumstances. So let's drop the check. In any case code will
work correctly, at worst truncating a part of a
2025-12-24
Published