cve-2023-52920
Vulnerability from cvelistv5
Published
2024-11-05 10:09
Modified
2024-12-19 08:28
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from stack in precision tracking Use instruction (jump) history to record instructions that performed register spill/fill to/from stack, regardless if this was done through read-only r10 register, or any other register after copying r10 into it *and* potentially adjusting offset. To make this work reliably, we push extra per-instruction flags into instruction history, encoding stack slot index (spi) and stack frame number in extra 10 bit flags we take away from prev_idx in instruction history. We don't touch idx field for maximum performance, as it's checked most frequently during backtracking. This change removes basically the last remaining practical limitation of precision backtracking logic in BPF verifier. It fixes known deficiencies, but also opens up new opportunities to reduce number of verified states, explored in the subsequent patches. There are only three differences in selftests' BPF object files according to veristat, all in the positive direction (less states). File Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF) -------------------------------------- ------------- --------- --------- ------------- ---------- ---------- ------------- test_cls_redirect_dynptr.bpf.linked3.o cls_redirect 2987 2864 -123 (-4.12%) 240 231 -9 (-3.75%) xdp_synproxy_kern.bpf.linked3.o syncookie_tc 82848 82661 -187 (-0.23%) 5107 5073 -34 (-0.67%) xdp_synproxy_kern.bpf.linked3.o syncookie_xdp 85116 84964 -152 (-0.18%) 5162 5130 -32 (-0.62%) Note, I avoided renaming jmp_history to more generic insn_hist to minimize number of lines changed and potential merge conflicts between bpf and bpf-next trees. Notice also cur_hist_entry pointer reset to NULL at the beginning of instruction verification loop. This pointer avoids the problem of relying on last jump history entry's insn_idx to determine whether we already have entry for current instruction or not. It can happen that we added jump history entry because current instruction is_jmp_point(), but also we need to add instruction flags for stack access. In this case, we don't want to entries, so we need to reuse last added entry, if it is present. Relying on insn_idx comparison has the same ambiguity problem as the one that was fixed recently in [0], so we avoid that. [0] https://patchwork.kernel.org/project/netdevbpf/patch/20231110002638.4168352-3-andrii@kernel.org/
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/41f6f64e6999a837048b1bd13a2f8742964eca6bMailing List, Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ecc2aeeaa08a355d84d3ca9c3d2512399a194f29
Impacted products
Vendor Product Version
Linux Linux
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf_verifier.h",
            "kernel/bpf/verifier.c",
            "tools/testing/selftests/bpf/progs/verifier_subprog_precision.c",
            "tools/testing/selftests/bpf/verifier/precise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ecc2aeeaa08a355d84d3ca9c3d2512399a194f29",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "41f6f64e6999a837048b1bd13a2f8742964eca6b",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf_verifier.h",
            "kernel/bpf/verifier.c",
            "tools/testing/selftests/bpf/progs/verifier_subprog_precision.c",
            "tools/testing/selftests/bpf/verifier/precise.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.64",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: support non-r10 register spill/fill to/from stack in precision tracking\n\nUse instruction (jump) history to record instructions that performed\nregister spill/fill to/from stack, regardless if this was done through\nread-only r10 register, or any other register after copying r10 into it\n*and* potentially adjusting offset.\n\nTo make this work reliably, we push extra per-instruction flags into\ninstruction history, encoding stack slot index (spi) and stack frame\nnumber in extra 10 bit flags we take away from prev_idx in instruction\nhistory. We don\u0027t touch idx field for maximum performance, as it\u0027s\nchecked most frequently during backtracking.\n\nThis change removes basically the last remaining practical limitation of\nprecision backtracking logic in BPF verifier. It fixes known\ndeficiencies, but also opens up new opportunities to reduce number of\nverified states, explored in the subsequent patches.\n\nThere are only three differences in selftests\u0027 BPF object files\naccording to veristat, all in the positive direction (less states).\n\nFile                                    Program        Insns (A)  Insns (B)  Insns  (DIFF)  States (A)  States (B)  States (DIFF)\n--------------------------------------  -------------  ---------  ---------  -------------  ----------  ----------  -------------\ntest_cls_redirect_dynptr.bpf.linked3.o  cls_redirect        2987       2864  -123 (-4.12%)         240         231    -9 (-3.75%)\nxdp_synproxy_kern.bpf.linked3.o         syncookie_tc       82848      82661  -187 (-0.23%)        5107        5073   -34 (-0.67%)\nxdp_synproxy_kern.bpf.linked3.o         syncookie_xdp      85116      84964  -152 (-0.18%)        5162        5130   -32 (-0.62%)\n\nNote, I avoided renaming jmp_history to more generic insn_hist to\nminimize number of lines changed and potential merge conflicts between\nbpf and bpf-next trees.\n\nNotice also cur_hist_entry pointer reset to NULL at the beginning of\ninstruction verification loop. This pointer avoids the problem of\nrelying on last jump history entry\u0027s insn_idx to determine whether we\nalready have entry for current instruction or not. It can happen that we\nadded jump history entry because current instruction is_jmp_point(), but\nalso we need to add instruction flags for stack access. In this case, we\ndon\u0027t want to entries, so we need to reuse last added entry, if it is\npresent.\n\nRelying on insn_idx comparison has the same ambiguity problem as the one\nthat was fixed recently in [0], so we avoid that.\n\n  [0] https://patchwork.kernel.org/project/netdevbpf/patch/20231110002638.4168352-3-andrii@kernel.org/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T08:28:34.900Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ecc2aeeaa08a355d84d3ca9c3d2512399a194f29"
        },
        {
          "url": "https://git.kernel.org/stable/c/41f6f64e6999a837048b1bd13a2f8742964eca6b"
        }
      ],
      "title": "bpf: support non-r10 register spill/fill to/from stack in precision tracking",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52920",
    "datePublished": "2024-11-05T10:09:30.280Z",
    "dateReserved": "2024-08-21T06:07:11.017Z",
    "dateUpdated": "2024-12-19T08:28:34.900Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-52920\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-11-05T10:15:24.580\",\"lastModified\":\"2024-12-09T11:15:05.403\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: support non-r10 register spill/fill to/from stack in precision tracking\\n\\nUse instruction (jump) history to record instructions that performed\\nregister spill/fill to/from stack, regardless if this was done through\\nread-only r10 register, or any other register after copying r10 into it\\n*and* potentially adjusting offset.\\n\\nTo make this work reliably, we push extra per-instruction flags into\\ninstruction history, encoding stack slot index (spi) and stack frame\\nnumber in extra 10 bit flags we take away from prev_idx in instruction\\nhistory. We don\u0027t touch idx field for maximum performance, as it\u0027s\\nchecked most frequently during backtracking.\\n\\nThis change removes basically the last remaining practical limitation of\\nprecision backtracking logic in BPF verifier. It fixes known\\ndeficiencies, but also opens up new opportunities to reduce number of\\nverified states, explored in the subsequent patches.\\n\\nThere are only three differences in selftests\u0027 BPF object files\\naccording to veristat, all in the positive direction (less states).\\n\\nFile                                    Program        Insns (A)  Insns (B)  Insns  (DIFF)  States (A)  States (B)  States (DIFF)\\n--------------------------------------  -------------  ---------  ---------  -------------  ----------  ----------  -------------\\ntest_cls_redirect_dynptr.bpf.linked3.o  cls_redirect        2987       2864  -123 (-4.12%)         240         231    -9 (-3.75%)\\nxdp_synproxy_kern.bpf.linked3.o         syncookie_tc       82848      82661  -187 (-0.23%)        5107        5073   -34 (-0.67%)\\nxdp_synproxy_kern.bpf.linked3.o         syncookie_xdp      85116      84964  -152 (-0.18%)        5162        5130   -32 (-0.62%)\\n\\nNote, I avoided renaming jmp_history to more generic insn_hist to\\nminimize number of lines changed and potential merge conflicts between\\nbpf and bpf-next trees.\\n\\nNotice also cur_hist_entry pointer reset to NULL at the beginning of\\ninstruction verification loop. This pointer avoids the problem of\\nrelying on last jump history entry\u0027s insn_idx to determine whether we\\nalready have entry for current instruction or not. It can happen that we\\nadded jump history entry because current instruction is_jmp_point(), but\\nalso we need to add instruction flags for stack access. In this case, we\\ndon\u0027t want to entries, so we need to reuse last added entry, if it is\\npresent.\\n\\nRelying on insn_idx comparison has the same ambiguity problem as the one\\nthat was fixed recently in [0], so we avoid that.\\n\\n  [0] https://patchwork.kernel.org/project/netdevbpf/patch/20231110002638.4168352-3-andrii@kernel.org/\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: soporte para derrame/relleno de registros que no sean r10 hacia/desde la pila en seguimiento de precisi\u00f3n. Use el historial de instrucciones (saltos) para registrar instrucciones que realizaron derrame/relleno de registros hacia/desde la pila, independientemente de si esto se hizo a trav\u00e9s de un registro r10 de solo lectura, o cualquier otro registro despu\u00e9s de copiar r10 en \u00e9l *y* potencialmente ajustar el desplazamiento. Para que esto funcione de manera confiable, insertamos indicadores adicionales por instrucci\u00f3n en el historial de instrucciones, codificando el \u00edndice de ranura de pila (spi) y el n\u00famero de marco de pila en indicadores adicionales de 10 bits que quitamos de prev_idx en el historial de instrucciones. No tocamos el campo idx para obtener el m\u00e1ximo rendimiento, ya que se verifica con mayor frecuencia durante el seguimiento hacia atr\u00e1s. Este cambio elimina b\u00e1sicamente la \u00faltima limitaci\u00f3n pr\u00e1ctica restante de la l\u00f3gica de seguimiento hacia atr\u00e1s de precisi\u00f3n en el verificador BPF. Corrige deficiencias conocidas, pero tambi\u00e9n abre nuevas oportunidades para reducir la cantidad de estados verificados, exploradas en los parches posteriores. Solo hay tres diferencias en los archivos de objetos BPF de las autopruebas seg\u00fan veristat, todas en la direcci\u00f3n positiva (menos estados). Archivo Programa Insns (A) Insns (B) Insns (DIFF) Estados (A) Estados (B) Estados (DIFF) -------------------------------------- ------------- --------- --------- ------------- ---------- ---------- ------------- test_cls_redirect_dynptr.bpf.linked3.o cls_redirect 2987 2864 -123 (-4,12%) 240 231 -9 (-3,75%) xdp_synproxy_kern.bpf.linked3.o syncookie_tc 82848 82661 -187 (-0,23%) 5107 5073 -34 (-0,67%) xdp_synproxy_kern.bpf.linked3.o syncookie_xdp 85116 84964 -152 (-0,18%) 5162 5130 -32 (-0,62%) Nota: evit\u00e9 cambiar el nombre de jmp_history al m\u00e1s gen\u00e9rico insn_hist para minimizar la cantidad de l\u00edneas cambiadas y los posibles conflictos de fusi\u00f3n entre los \u00e1rboles bpf y bpf-next. Observe tambi\u00e9n que el puntero cur_hist_entry se restablece a NULL al comienzo del bucle de verificaci\u00f3n de instrucciones. Este puntero evita el problema de confiar en el insn_idx de la \u00faltima entrada del historial de saltos para determinar si ya tenemos una entrada para la instrucci\u00f3n actual o no. Puede suceder que agreguemos una entrada del historial de saltos porque la instrucci\u00f3n actual es_jmp_point(), pero tambi\u00e9n necesitamos agregar indicadores de instrucci\u00f3n para el acceso a la pila. En este caso, no queremos entradas, por lo que necesitamos reutilizar la \u00faltima entrada agregada, si est\u00e1 presente. Confiar en la comparaci\u00f3n insn_idx tiene el mismo problema de ambig\u00fcedad que el que se solucion\u00f3 recientemente en [0], por lo que lo evitamos. [0] https://patchwork.kernel.org/project/netdevbpf/patch/20231110002638.4168352-3-andrii@kernel.org/\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.8\",\"matchCriteriaId\":\"D0B66B9B-B773-474F-A817-85A8F2B3CF0E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/41f6f64e6999a837048b1bd13a2f8742964eca6b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Mailing List\",\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ecc2aeeaa08a355d84d3ca9c3d2512399a194f29\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.