CVE-2023-52676

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Guard stack limits against 32bit overflow

This patch promotes the arithmetic around checking stack bounds to be

done in the 64-bit domain, instead of the current 32bit. The arithmetic

implies adding together a 64-bit register with a int offset. The

register was checked to be below 1<<29 when it was variable, but not

when it was fixed. The offset either comes from an instruction (in which

case it is 16 bit), from another register (in which case the caller

checked it to be below 1<<29 [1]), or from the size of an argument to a

kfunc (in which case it can be a u32 [2]). Between the register being

inconsistently checked to be below 1<<29, and the offset being up to an

u32, it appears that we were open to overflowing the `int`s which were

currently used for arithmetic.

[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498

[2] https://github.com/torvalds

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References