CVE-2023-53024

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation

To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to

insufficient speculative store bypass mitigation") inserts lfence

instructions after 1) initializing a stack slot and 2) spilling a

pointer to the stack.

However, this does not cover cases where a stack slot is first

initialized with a pointer (subject to sanitization) but then

overwritten with a scalar (not subject to sanitization because

the slot was already initialized). In this case, the second write

may be subject to speculative store bypass (SSB) creating a

speculative pointer-as-scalar type confusion. This allows the

program to subsequently leak the numerical pointer value using,

for example, a branch-based cache side channel.

To fix this, also sanitize scalars if they write a stack slot

that previously contained a pointer. Assuming that pointer-spills

are only generate

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References