CVE-2023-54086: bpf: Add preempt_count_{sub,add} into btf id deny list
In the Linux kernel, the following vulnerability has been resolved:
bpf: Add preemptcount{sub,add} into btf id deny list
The recursion check in bpfprogenter and bpfprogexit leave preemptcount{sub,add} unprotected. When attaching trampoline to them we get panic as follows,
[ 867.843050] BUG: TASK stack guard page was hit at 0000000009d325cf (stack is 0000000046a46a15..00000000537e7b28) [ 867.843064] stack guard page: 0000 [#1] PREEMPT SMP NOPTI [ 867.843067] CPU: 8 PID: 11009 Comm: trace Kdump: loaded Not tainted 6.2.0+ #4 [ 867.843100] Call Trace: [ 867.843101] <TASK> [ 867.843104] asmexcint3+0x3a/0x40 [ 867.843108] RIP: 0010:preemptcountsub+0x1/0xa0 [ 867.843135] bpfprogenterrecur+0x17/0x90 [ 867.843148] bpftrampoline64424681080+0x2e/0x1000 [ 867.843154] ? preemptcountsub+0x1/0xa0 [ 867.843157] preemptcountsub+0x5/0xa0 [ 867.843159] ? migrateenable+0xac/0xf0 [ 867.843164] bpfprogexitrecur+0x2d/0x40 [ 867.843168] bpftrampoline64424681080+0x55/0x1000 ... [ 867.843788] preemptcountsub+0x5/0xa0 [ 867.843793] ? migrateenable+0xac/0xf0 [ 867.843829] bpfprogexitrecur+0x2d/0x40 [ 867.843837] BUG: IRQ stack guard page was hit at 0000000099bd8228 (stack is 00000000b23e2bc4..000000006d95af35) [ 867.843841] BUG: IRQ stack guard page was hit at 000000005ae07924 (stack is 00000000ffd69623..0000000014eb594c) [ 867.843843] BUG: IRQ stack guard page was hit at 00000000028320f0 (stack is 00000000034b6438..0000000078d1bcec) [ 867.843842] bpftrampoline64424681080+0x55/0x1000 ...
That is because in bpfprogexitrecur, the preemptcount{sub,add} are called after prog->active is decreased.
Fixing this by adding these two functions into btf ids deny list.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54086?
CVE-2023-54086 has a severity classified as moderate due to the potential for kernel panic.
How do I fix CVE-2023-54086?
To fix CVE-2023-54086, you should update the Linux kernel to the latest version that includes the patch addressing this vulnerability.
Which versions of Linux Kernel are affected by CVE-2023-54086?
CVE-2023-54086 affects Linux kernel version 6.2.0 and later versions prior to the application of the patch.
What type of vulnerability is CVE-2023-54086?
CVE-2023-54086 is a denial of service vulnerability that can lead to kernel panic in affected systems.
Is CVE-2023-54086 exploitable remotely?
CVE-2023-54086 is not known to be exploitable remotely as it requires local execution context.