CVE-2023-54173: bpf: Disable preemption in bpf_event_output
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disable preemption in bpfeventoutput
We received report [1] of kernel crash, which is caused by using nesting protection without disabled preemption.
The bpfeventoutput can be called by programs executed by bpfprogrunarraycg function that disabled migration but keeps preemption enabled.
This can cause task to be preempted by another one inside the nesting protection and lead eventually to two tasks using same perfsampledata buffer and cause crashes like:
BUG: kernel NULL pointer dereference, address: 0000000000000001 #PF: supervisor instruction fetch in kernel mode #PF: errorcode(0x0010) - not-present page ... ? perfoutputsample+0x12a/0x9a0 ? finishtaskswitch.isra.0+0x81/0x280 ? perfeventoutput+0x66/0xa0 ? bpfeventoutput+0x13a/0x190 ? bpfeventoutputdata+0x22/0x40 ? bpfprogdfc84bbde731b257cilsock4connect+0x40a/0xacb ? xaload+0x87/0xe0 ? cgroupbpfrunfiltersockaddr+0xc1/0x1a0 ? releasesock+0x3e/0x90 ? sksetsockopt+0x1a1/0x12f0 ? udppreconnect+0x36/0x50 ? inetdgramconnect+0x93/0xa0 ? sysconnect+0xb4/0xe0 ? udpsetsockopt+0x27/0x40 ? pfxudppushpendingframes+0x10/0x10 ? syssetsockopt+0xdf/0x1a0 ? x64sysconnect+0xf/0x20 ? dosyscall64+0x3a/0x90 ? entrySYSCALL64afterhwframe+0x72/0xdc
Fixing this by disabling preemption in bpfeventoutput.
[1] https://github.com/cilium/cilium/issues/26756
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the kernel fix for the described issue by disabling preemption in bpf_event_output (as referenced by the text: "Fixing this by disabling preemption in bpf_event_output" and "bpf: Disable preemption in bpf_event_output").
Linux kernel (bpf_event_output) preemption in bpf_event_output = disabled
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54173?
CVE-2023-54173 has been classified as a moderate severity vulnerability.
How do I fix CVE-2023-54173?
To fix CVE-2023-54173, ensure you update the Linux kernel to the latest version that addresses this issue.
What versions of Linux kernel are affected by CVE-2023-54173?
CVE-2023-54173 affects various versions of the Linux kernel prior to the patch being applied.
What are the implications of CVE-2023-54173?
CVE-2023-54173 can lead to a kernel crash due to improper nesting protection when preemption is enabled.
Is there any workaround for CVE-2023-54173 before applying a fix?
There are no specific workarounds recommended for CVE-2023-54173, so updating the kernel is the best approach.