CVE-2023-52621

bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers

Severity Score

4.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

Track

*SSVC

Descriptions

In the Linux kernel, the following vulnerability has been resolved:

bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers

These three bpf_map_{lookup,update,delete}_elem() helpers are also
available for sleepable bpf program, so add the corresponding lock
assertion for sleepable bpf program, otherwise the following warning
will be reported when a sleepable bpf program manipulates bpf map under
interpreter mode (aka bpf_jit_enable=0):

WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ......
CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ......
RIP: 0010:bpf_map_lookup_elem+0x54/0x60
......
Call Trace:
<TASK>
? __warn+0xa5/0x240
? bpf_map_lookup_elem+0x54/0x60
? report_bug+0x1ba/0x1f0
? handle_bug+0x40/0x80
? exc_invalid_op+0x18/0x50
? asm_exc_invalid_op+0x1b/0x20
? __pfx_bpf_map_lookup_elem+0x10/0x10
? rcu_lockdep_current_cpu_online+0x65/0xb0
? rcu_is_watching+0x23/0x50
? bpf_map_lookup_elem+0x54/0x60
? __pfx_bpf_map_lookup_elem+0x10/0x10
___bpf_prog_run+0x513/0x3b70
__bpf_prog_run32+0x9d/0xd0
? __bpf_prog_enter_sleepable_recur+0xad/0x120
? __bpf_prog_enter_sleepable_recur+0x3e/0x120
bpf_trampoline_6442580665+0x4d/0x1000
__x64_sys_getpgid+0x5/0x30
? do_syscall_64+0x36/0xb0
entry_SYSCALL_64_after_hwframe+0x6e/0x76
</TASK>

En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: verifique rcu_read_lock_trace_held() antes de llamar a los ayudantes de mapas de bpf. Estos tres ayudantes de bpf_map_{lookup,update,delete}_elem() también están disponibles para el programa bpf que se puede dormir, así que agregue el bloqueo correspondiente. aserción para el programa bpf con capacidad para dormir; de lo contrario, se informará la siguiente advertencia cuando un programa bpf con capacidad para dormir manipule el mapa bpf en modo intérprete (también conocido como bpf_jit_enable=0): ADVERTENCIA: CPU: 3 PID: 4985 en kernel/bpf/helpers.c:40. ..... CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2 Nombre del hardware: PC estándar QEMU (i440FX + PIIX, 1996) ...... RIP: 0010:bpf_map_lookup_elem+0x54/0x60 ...... Seguimiento de llamadas: ? __advertir+0xa5/0x240 ? bpf_map_lookup_elem+0x54/0x60? report_bug+0x1ba/0x1f0? handle_bug+0x40/0x80? exc_invalid_op+0x18/0x50? asm_exc_invalid_op+0x1b/0x20? __pfx_bpf_map_lookup_elem+0x10/0x10 ? rcu_lockdep_current_cpu_online+0x65/0xb0? rcu_is_watching+0x23/0x50? bpf_map_lookup_elem+0x54/0x60? __pfx_bpf_map_lookup_elem+0x10/0x10 ___bpf_prog_run+0x513/0x3b70 __bpf_prog_run32+0x9d/0xd0 ? __bpf_prog_enter_sleepable_recur+0xad/0x120 ? __bpf_prog_enter_sleepable_recur+0x3e/0x120 bpf_trampoline_6442580665+0x4d/0x1000 __x64_sys_getpgid+0x5/0x30 ? do_syscall_64+0x36/0xb0 entrada_SYSCALL_64_after_hwframe+0x6e/0x76

*Credits: N/A

CVSS Scores

Red Hatv3.1 4.4

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:Track

Exploitation

None

Automatable

Tech. Impact

Partial

* Organization's Worst-case Scenario

Timeline

2024-03-06 CVE Reserved
2024-03-26 CVE Published
2024-03-27 EPSS Updated
2024-12-19 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-413: Improper Resource Locking

CAPEC

References (6)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://git.kernel.org/stable/c/d6d6fe4bb105595118f12abeed4a7bdd450853f3	2024-02-05
https://git.kernel.org/stable/c/483cb92334cd7f1d5387dccc0ab5d595d27a669d	2024-02-05
https://git.kernel.org/stable/c/c7f1b6146f4a46d727c0d046284c28b6882c6304	2024-02-05
https://git.kernel.org/stable/c/169410eba271afc9f0fb476d996795aa26770c6d	2023-12-05

URL	Date	SRC
https://access.redhat.com/security/cve/CVE-2023-52621	2024-11-12
https://bugzilla.redhat.com/show_bug.cgi?id=2271690	2024-11-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.1.77 Search vendor "Linux" for product "Linux Kernel" and version " < 6.1.77"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.6.16 Search vendor "Linux" for product "Linux Kernel" and version " < 6.6.16"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.7.4 Search vendor "Linux" for product "Linux Kernel" and version " < 6.7.4"		en		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				< 6.8 Search vendor "Linux" for product "Linux Kernel" and version " < 6.8"		en		Affected