CVE-2023-52676 (GCVE-0-2023-52676)

Vulnerability from cvelistv5 – Published: 2024-05-17 14:24 – Updated: 2026-08-05 09:10
VLAI
Title
bpf: Guard stack limits against 32bit overflow
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Guard stack limits against 32bit overflow This patch promotes the arithmetic around checking stack bounds to be done in the 64-bit domain, instead of the current 32bit. The arithmetic implies adding together a 64-bit register with a int offset. The register was checked to be below 1<<29 when it was variable, but not when it was fixed. The offset either comes from an instruction (in which case it is 16 bit), from another register (in which case the caller checked it to be below 1<<29 [1]), or from the size of an argument to a kfunc (in which case it can be a u32 [2]). Between the register being inconsistently checked to be below 1<<29, and the offset being up to an u32, it appears that we were open to overflowing the `int`s which were currently used for arithmetic. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498 [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 01f810ace9ed37255f27608a0864abebccf0aab3 , < ad140fc856f0b1d5e2215bcb6d0cc247a86805a2 (git)
Affected: 01f810ace9ed37255f27608a0864abebccf0aab3 , < e5ad9ecb84405637df82732ee02ad741a5f782a6 (git)
Affected: 01f810ace9ed37255f27608a0864abebccf0aab3 , < 1d38a9ee81570c4bd61f557832dead4d6f816760 (git)
Affected: f3c4b01689d392373301e6e60d1b02c5b4020afc (git)
Affected: d1b725ea5d104caea250427899f4e2e3ab15b4fc (git)
Affected: 5.10.33 , < 5.11 (semver)
Affected: 5.11.17 , < 5.12 (semver)
Create a notification for this product.
Linux Linux Affected: 5.12
Unaffected: 0 , < 5.12 (semver)
Unaffected: 6.6.14 , ≤ 6.6.* (semver)
Unaffected: 6.7.2 , ≤ 6.7.* (semver)
Unaffected: 6.8 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52676",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T15:14:32.563852Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T15:14:46.799Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:34.390Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad140fc856f0b1d5e2215bcb6d0cc247a86805a2",
              "status": "affected",
              "version": "01f810ace9ed37255f27608a0864abebccf0aab3",
              "versionType": "git"
            },
            {
              "lessThan": "e5ad9ecb84405637df82732ee02ad741a5f782a6",
              "status": "affected",
              "version": "01f810ace9ed37255f27608a0864abebccf0aab3",
              "versionType": "git"
            },
            {
              "lessThan": "1d38a9ee81570c4bd61f557832dead4d6f816760",
              "status": "affected",
              "version": "01f810ace9ed37255f27608a0864abebccf0aab3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f3c4b01689d392373301e6e60d1b02c5b4020afc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d1b725ea5d104caea250427899f4e2e3ab15b4fc",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.33",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.17",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.11.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard stack limits against 32bit overflow\n\nThis patch promotes the arithmetic around checking stack bounds to be\ndone in the 64-bit domain, instead of the current 32bit. The arithmetic\nimplies adding together a 64-bit register with a int offset. The\nregister was checked to be below 1\u003c\u003c29 when it was variable, but not\nwhen it was fixed. The offset either comes from an instruction (in which\ncase it is 16 bit), from another register (in which case the caller\nchecked it to be below 1\u003c\u003c29 [1]), or from the size of an argument to a\nkfunc (in which case it can be a u32 [2]). Between the register being\ninconsistently checked to be below 1\u003c\u003c29, and the offset being up to an\nu32, it appears that we were open to overflowing the `int`s which were\ncurrently used for arithmetic.\n\n[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498\n[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the BPF verifier\u0027s stack bounds checking during bpf(BPF_PROG_LOAD); it is reached only via a local syscall, not via network packet processing.\nAC:L - An attacker fully controls the submitted BPF bytecode and offsets/sizes that feed the overflowing int arithmetic, so the bad bounds calculation can be triggered reliably with no conditions outside attacker control.\nPR:L - The vulnerable const stack-bounds path runs for ordinary stack accesses during program load, including for unprivileged SOCKET_FILTER/CGROUP_SKB when unprivileged BPF is enabled; CAP_BPF is not required for all reachability paths.\nUI:N - Exploitation requires only calling bpf() with a crafted program; no victim interaction is needed.\nS:U - Impact stays within the host kernel authority (verifier memory corruption and/or local privilege escalation); this is not a VM/IOMMU/guest-to-host boundary crossing.\nC:H - Integer overflow can bypass stack bounds checks and lead to out-of-bounds accesses of verifier stack-slot state and/or runtime BPF stack, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same overflow enables out-of-bounds writes in verifier tracking and/or a verifier bypass allowing corrupted BPF stack accesses at runtime, which is exploitable for control-flow hijacking and privilege escalation.\nA:H - Failed bounds math has caused out-of-bounds accesses and kernel oopses in check_stack_range_initialized() during verification, so availability impact is a full kernel crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:10:58.656Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760"
        }
      ],
      "title": "bpf: Guard stack limits against 32bit overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52676",
    "datePublished": "2024-05-17T14:24:41.387Z",
    "dateReserved": "2024-03-07T14:49:46.886Z",
    "dateUpdated": "2026-08-05T09:10:58.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-52676",
      "date": "2026-08-10",
      "epss": "0.00236",
      "percentile": "0.14595"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Guard stack limits against 32bit overflow\\n\\nThis patch promotes the arithmetic around checking stack bounds to be\\ndone in the 64-bit domain, instead of the current 32bit. The arithmetic\\nimplies adding together a 64-bit register with a int offset. The\\nregister was checked to be below 1\u003c\u003c29 when it was variable, but not\\nwhen it was fixed. The offset either comes from an instruction (in which\\ncase it is 16 bit), from another register (in which case the caller\\nchecked it to be below 1\u003c\u003c29 [1]), or from the size of an argument to a\\nkfunc (in which case it can be a u32 [2]). Between the register being\\ninconsistently checked to be below 1\u003c\u003c29, and the offset being up to an\\nu32, it appears that we were open to overflowing the `int`s which were\\ncurrently used for arithmetic.\\n\\n[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498\\n[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Proteger los l\\u00edmites de la pila contra el desbordamiento de 32 bits. Este parche promueve que la aritm\\u00e9tica en torno a la verificaci\\u00f3n de los l\\u00edmites de la pila se realice en el dominio de 64 bits, en lugar del actual de 32 bits. La aritm\\u00e9tica implica sumar un registro de 64 bits con un desplazamiento int. Se comprob\\u00f3 que el registro estaba por debajo de 1\u0026lt;\u0026lt;29 cuando era variable, pero no cuando estaba arreglado. El desplazamiento proviene de una instrucci\\u00f3n (en cuyo caso es de 16 bits), de otro registro (en cuyo caso la persona que llama comprob\\u00f3 que estaba por debajo de 1\u0026lt;\u0026lt;29 [1]) o del tama\\u00f1o de un argumento para kfunc. (en cuyo caso puede ser un u32 [2]). Entre que el registro se verificaba de manera inconsistente para que estuviera por debajo de 1\u0026lt;\u0026lt;29 y el desplazamiento era de hasta u32, parece que est\\u00e1bamos abiertos a desbordar los \\\"int\\\" que se usaban actualmente para la aritm\\u00e9tica. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498 [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e 50f6cd80eb10235fe3e9/n\\u00facleo /bpf/verifier.c#L11904\"}]",
      "id": "CVE-2023-52676",
      "lastModified": "2024-11-21T08:40:20.363",
      "published": "2024-05-17T15:15:18.633",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "microsoft_vex": {
      "current_release_date": "2026-04-01T01:51:22.000Z",
      "cve": "CVE-2023-52676",
      "id": "msrc_CVE-2023-52676",
      "initial_release_date": "2024-05-02T07:00:00.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "bpf: Guard stack limits against 32bit overflow",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2023-52676.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52676\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-17T15:15:18.633\",\"lastModified\":\"2026-08-04T10:18:37.390\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Guard stack limits against 32bit overflow\\n\\nThis patch promotes the arithmetic around checking stack bounds to be\\ndone in the 64-bit domain, instead of the current 32bit. The arithmetic\\nimplies adding together a 64-bit register with a int offset. The\\nregister was checked to be below 1\u003c\u003c29 when it was variable, but not\\nwhen it was fixed. The offset either comes from an instruction (in which\\ncase it is 16 bit), from another register (in which case the caller\\nchecked it to be below 1\u003c\u003c29 [1]), or from the size of an argument to a\\nkfunc (in which case it can be a u32 [2]). Between the register being\\ninconsistently checked to be below 1\u003c\u003c29, and the offset being up to an\\nu32, it appears that we were open to overflowing the `int`s which were\\ncurrently used for arithmetic.\\n\\n[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498\\n[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Proteger los l\u00edmites de la pila contra el desbordamiento de 32 bits. Este parche promueve que la aritm\u00e9tica en torno a la verificaci\u00f3n de los l\u00edmites de la pila se realice en el dominio de 64 bits, en lugar del actual de 32 bits. La aritm\u00e9tica implica sumar un registro de 64 bits con un desplazamiento int. Se comprob\u00f3 que el registro estaba por debajo de 1\u0026lt;\u0026lt;29 cuando era variable, pero no cuando estaba arreglado. El desplazamiento proviene de una instrucci\u00f3n (en cuyo caso es de 16 bits), de otro registro (en cuyo caso la persona que llama comprob\u00f3 que estaba por debajo de 1\u0026lt;\u0026lt;29 [1]) o del tama\u00f1o de un argumento para kfunc. (en cuyo caso puede ser un u32 [2]). Entre que el registro se verificaba de manera inconsistente para que estuviera por debajo de 1\u0026lt;\u0026lt;29 y el desplazamiento era de hasta u32, parece que est\u00e1bamos abiertos a desbordar los \\\"int\\\" que se usaban actualmente para la aritm\u00e9tica. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498 [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e 50f6cd80eb10235fe3e9/n\u00facleo /bpf/verifier.c#L11904\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/bpf/verifier.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"01f810ace9ed37255f27608a0864abebccf0aab3\",\"lessThan\":\"ad140fc856f0b1d5e2215bcb6d0cc247a86805a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01f810ace9ed37255f27608a0864abebccf0aab3\",\"lessThan\":\"e5ad9ecb84405637df82732ee02ad741a5f782a6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"01f810ace9ed37255f27608a0864abebccf0aab3\",\"lessThan\":\"1d38a9ee81570c4bd61f557832dead4d6f816760\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f3c4b01689d392373301e6e60d1b02c5b4020afc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d1b725ea5d104caea250427899f4e2e3ab15b4fc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.33\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.11.17\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/bpf/verifier.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.14\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.7.2\",\"lessThanOrEqual\":\"6.7.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.8\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-06-12T15:14:32.563852Z\",\"id\":\"CVE-2023-52676\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.33\",\"versionEndExcluding\":\"5.11\",\"matchCriteriaId\":\"2EEAEE35-CD34-43B5-8F63-EA8A43513930\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11.17\",\"versionEndExcluding\":\"6.6.14\",\"matchCriteriaId\":\"F024C7CE-4C5E-46AF-AEA5-D041B2AA3B2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.7.2\",\"matchCriteriaId\":\"7229C448-E0C9-488B-8939-36BA5254065E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-08-04T22:57:27+00:00",
      "cve": "CVE-2023-52676",
      "id": "CVE-2023-52676",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:fixed": "280",
      "product_status:known_affected": "98",
      "product_status:known_not_affected": "22",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: bpf: Guard stack limits against 32bit overflow",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-52676.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-05T01:06:32Z",
      "cve": "CVE-2023-52676",
      "id": "CVE-2023-52676",
      "initial_release_date": "2024-05-21T02:02:05Z",
      "product_status:known_affected": "354",
      "product_status:known_not_affected": "157",
      "product_status:recommended": "735",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2023-52676",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2023-52676.json",
      "version": "89"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:11:34.390Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52676\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-12T15:14:32.563852Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-12T15:14:42.452Z\"}}], \"cna\": {\"title\": \"bpf: Guard stack limits against 32bit overflow\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is in the BPF verifier\u0027s stack bounds checking during bpf(BPF_PROG_LOAD); it is reached only via a local syscall, not via network packet processing.\\nAC:L - An attacker fully controls the submitted BPF bytecode and offsets/sizes that feed the overflowing int arithmetic, so the bad bounds calculation can be triggered reliably with no conditions outside attacker control.\\nPR:L - The vulnerable const stack-bounds path runs for ordinary stack accesses during program load, including for unprivileged SOCKET_FILTER/CGROUP_SKB when unprivileged BPF is enabled; CAP_BPF is not required for all reachability paths.\\nUI:N - Exploitation requires only calling bpf() with a crafted program; no victim interaction is needed.\\nS:U - Impact stays within the host kernel authority (verifier memory corruption and/or local privilege escalation); this is not a VM/IOMMU/guest-to-host boundary crossing.\\nC:H - Integer overflow can bypass stack bounds checks and lead to out-of-bounds accesses of verifier stack-slot state and/or runtime BPF stack, which can be leveraged for arbitrary kernel memory disclosure.\\nI:H - The same overflow enables out-of-bounds writes in verifier tracking and/or a verifier bypass allowing corrupted BPF stack accesses at runtime, which is exploitable for control-flow hijacking and privilege escalation.\\nA:H - Failed bounds math has caused out-of-bounds accesses and kernel oopses in check_stack_range_initialized() during verification, so availability impact is a full kernel crash.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"01f810ace9ed37255f27608a0864abebccf0aab3\", \"lessThan\": \"ad140fc856f0b1d5e2215bcb6d0cc247a86805a2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"01f810ace9ed37255f27608a0864abebccf0aab3\", \"lessThan\": \"e5ad9ecb84405637df82732ee02ad741a5f782a6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"01f810ace9ed37255f27608a0864abebccf0aab3\", \"lessThan\": \"1d38a9ee81570c4bd61f557832dead4d6f816760\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3c4b01689d392373301e6e60d1b02c5b4020afc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d1b725ea5d104caea250427899f4e2e3ab15b4fc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.10.33\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.11.17\", \"lessThan\": \"5.12\", \"versionType\": \"semver\"}], \"programFiles\": [\"kernel/bpf/verifier.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/bpf/verifier.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2\"}, {\"url\": \"https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6\"}, {\"url\": \"https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Guard stack limits against 32bit overflow\\n\\nThis patch promotes the arithmetic around checking stack bounds to be\\ndone in the 64-bit domain, instead of the current 32bit. The arithmetic\\nimplies adding together a 64-bit register with a int offset. The\\nregister was checked to be below 1\u003c\u003c29 when it was variable, but not\\nwhen it was fixed. The offset either comes from an instruction (in which\\ncase it is 16 bit), from another register (in which case the caller\\nchecked it to be below 1\u003c\u003c29 [1]), or from the size of an argument to a\\nkfunc (in which case it can be a u32 [2]). Between the register being\\ninconsistently checked to be below 1\u003c\u003c29, and the offset being up to an\\nu32, it appears that we were open to overflowing the `int`s which were\\ncurrently used for arithmetic.\\n\\n[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498\\n[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.14\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.2\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.10.33\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.11.17\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:10:58.656Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52676\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:10:58.656Z\", \"dateReserved\": \"2024-03-07T14:49:46.886Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T14:24:41.387Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.