CVE-2023-52676

Description

In the Linux kernel, the following vulnerability has been resolved:bpf: Guard stack limits against 32bit overflowThis patch promotes the arithmetic around checking stack bounds to bedone in the 64-bit domain, instead of the current 32bit. The arithmeticimplies adding together a 64-bit register with a int offset. Theregister was checked to be below 1<<29 when it was variable, but notwhen it was fixed. The offset either comes from an instruction (in whichcase it is 16 bit), from another register (in which case the callerchecked it to be below 1<<29 [1]), or from the size of an argument to akfunc (in which case it can be a u32 [2]). Between the register beinginconsistently checked to be below 1<<29, and the offset being up to anu32, it appears that we were open to overflowing the ints which werecurrently used for arithmetic.[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904

Risk Information

Associated Vulnerability

Patch Details

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234