cve-2023-52676
Vulnerability from cvelistv5
Published
2024-05-17 14:24
Modified
2024-08-02 23:11
Severity
Summary
bpf: Guard stack limits against 32bit overflow
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52676",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T15:14:32.563852Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T15:14:46.799Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:34.390Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad140fc856f0",
              "status": "affected",
              "version": "1da177e4c3f4",
              "versionType": "git"
            },
            {
              "lessThan": "e5ad9ecb8440",
              "status": "affected",
              "version": "1da177e4c3f4",
              "versionType": "git"
            },
            {
              "lessThan": "1d38a9ee8157",
              "status": "affected",
              "version": "1da177e4c3f4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard stack limits against 32bit overflow\n\nThis patch promotes the arithmetic around checking stack bounds to be\ndone in the 64-bit domain, instead of the current 32bit. The arithmetic\nimplies adding together a 64-bit register with a int offset. The\nregister was checked to be below 1\u003c\u003c29 when it was variable, but not\nwhen it was fixed. The offset either comes from an instruction (in which\ncase it is 16 bit), from another register (in which case the caller\nchecked it to be below 1\u003c\u003c29 [1]), or from the size of an argument to a\nkfunc (in which case it can be a u32 [2]). Between the register being\ninconsistently checked to be below 1\u003c\u003c29, and the offset being up to an\nu32, it appears that we were open to overflowing the `int`s which were\ncurrently used for arithmetic.\n\n[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498\n[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-29T05:15:42.474Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760"
        }
      ],
      "title": "bpf: Guard stack limits against 32bit overflow",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52676",
    "datePublished": "2024-05-17T14:24:41.387Z",
    "dateReserved": "2024-03-07T14:49:46.886Z",
    "dateUpdated": "2024-08-02T23:11:34.390Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52676\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T15:15:18.633\",\"lastModified\":\"2024-05-17T18:35:35.070\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Guard stack limits against 32bit overflow\\n\\nThis patch promotes the arithmetic around checking stack bounds to be\\ndone in the 64-bit domain, instead of the current 32bit. The arithmetic\\nimplies adding together a 64-bit register with a int offset. The\\nregister was checked to be below 1\u003c\u003c29 when it was variable, but not\\nwhen it was fixed. The offset either comes from an instruction (in which\\ncase it is 16 bit), from another register (in which case the caller\\nchecked it to be below 1\u003c\u003c29 [1]), or from the size of an argument to a\\nkfunc (in which case it can be a u32 [2]). Between the register being\\ninconsistently checked to be below 1\u003c\u003c29, and the offset being up to an\\nu32, it appears that we were open to overflowing the `int`s which were\\ncurrently used for arithmetic.\\n\\n[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498\\n[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Proteger los l\u00edmites de la pila contra el desbordamiento de 32 bits. Este parche promueve que la aritm\u00e9tica en torno a la verificaci\u00f3n de los l\u00edmites de la pila se realice en el dominio de 64 bits, en lugar del actual de 32 bits. La aritm\u00e9tica implica sumar un registro de 64 bits con un desplazamiento int. Se comprob\u00f3 que el registro estaba por debajo de 1\u0026lt;\u0026lt;29 cuando era variable, pero no cuando estaba arreglado. El desplazamiento proviene de una instrucci\u00f3n (en cuyo caso es de 16 bits), de otro registro (en cuyo caso la persona que llama comprob\u00f3 que estaba por debajo de 1\u0026lt;\u0026lt;29 [1]) o del tama\u00f1o de un argumento para kfunc. (en cuyo caso puede ser un u32 [2]). Entre que el registro se verificaba de manera inconsistente para que estuviera por debajo de 1\u0026lt;\u0026lt;29 y el desplazamiento era de hasta u32, parece que est\u00e1bamos abiertos a desbordar los \\\"int\\\" que se usaban actualmente para la aritm\u00e9tica. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498 [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e 50f6cd80eb10235fe3e9/n\u00facleo /bpf/verifier.c#L11904\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.