CVE-2023-53024 (GCVE-0-2023-53024)
Vulnerability from cvelistv5
Published
2025-03-27 16:43
Modified
2025-05-04 12:50
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation") inserts lfence instructions after 1) initializing a stack slot and 2) spilling a pointer to the stack. However, this does not cover cases where a stack slot is first initialized with a pointer (subject to sanitization) but then overwritten with a scalar (not subject to sanitization because the slot was already initialized). In this case, the second write may be subject to speculative store bypass (SSB) creating a speculative pointer-as-scalar type confusion. This allows the program to subsequently leak the numerical pointer value using, for example, a branch-based cache side channel. To fix this, also sanitize scalars if they write a stack slot that previously contained a pointer. Assuming that pointer-spills are only generated by LLVM on register-pressure, the performance impact on most real-world BPF programs should be small. The following unprivileged BPF bytecode drafts a minimal exploit and the mitigation: [...] // r6 = 0 or 1 (skalar, unknown user input) // r7 = accessible ptr for side channel // r10 = frame pointer (fp), to be leaked // r9 = r10 # fp alias to encourage ssb *(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked // lfence added here because of pointer spill to stack. // // Ommitted: Dummy bpf_ringbuf_output() here to train alias predictor // for no r9-r10 dependency. // *(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr // 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID, // store may be subject to SSB // // fix: also add an lfence when the slot contained a ptr // r8 = *(u64 *)(r9 - 8) // r8 = architecturally a scalar, speculatively a ptr // // leak ptr using branch-based cache side channel: r8 &= 1 // choose bit to leak if r8 == 0 goto SLOW // no mispredict // architecturally dead code if input r6 is 0, // only executes speculatively iff ptr bit is 1 r8 = *(u64 *)(r7 + 0) # encode bit in cache (0: slow, 1: fast) SLOW: [...] After running this, the program can time the access to *(r7 + 0) to determine whether the chosen pointer bit was 0 or 1. Repeat this 64 times to recover the whole address on amd64. In summary, sanitization can only be skipped if one scalar is overwritten with another scalar. Scalar-confusion due to speculative store bypass can not lead to invalid accesses because the pointer bounds deducted during verification are enforced using branchless logic. See 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic") for details. Do not make the mitigation depend on !env->allow_{uninit_stack,ptr_leaks} because speculative leaks are likely unexpected if these were enabled. For example, leaking the address to a protected log file may be acceptable while disabling the mitigation might unintentionally leak the address into the cached-state of a map that is accessible to unprivileged processes.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/81b3374944d201872cfcf82730a7860f8e7c31dd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/aae109414a57ab4164218f36e2e4a17f027fcaaa
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b0c89ef025562161242a7c19b213bd6b272e93df
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/da75dec7c6617bddad418159ffebcb133f008262
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e4f4db47794c9f474b184ee1418f42e6a07412b6
Impacted products
Vendor Product Version
Linux Linux Version: 872968502114d68c21419cf7eb5ab97717e7b803
Version: f5893af2704eb763eb982f01d573f5b19f06b623
Version: 0e9280654aa482088ee6ef3deadef331f5ac5fb0
Version: 2039f26f3aca5b0e419b98f65dd36481337b86ee
Version: 2039f26f3aca5b0e419b98f65dd36481337b86ee
Version: 2039f26f3aca5b0e419b98f65dd36481337b86ee
Version: 0b27bdf02c400684225ee5ee99970bcbf5082282
 Create a notification for this product.
   Linux Linux Version: 5.14
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aae109414a57ab4164218f36e2e4a17f027fcaaa",
              "status": "affected",
              "version": "872968502114d68c21419cf7eb5ab97717e7b803",
              "versionType": "git"
            },
            {
              "lessThan": "81b3374944d201872cfcf82730a7860f8e7c31dd",
              "status": "affected",
              "version": "f5893af2704eb763eb982f01d573f5b19f06b623",
              "versionType": "git"
            },
            {
              "lessThan": "da75dec7c6617bddad418159ffebcb133f008262",
              "status": "affected",
              "version": "0e9280654aa482088ee6ef3deadef331f5ac5fb0",
              "versionType": "git"
            },
            {
              "lessThan": "01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528",
              "status": "affected",
              "version": "2039f26f3aca5b0e419b98f65dd36481337b86ee",
              "versionType": "git"
            },
            {
              "lessThan": "b0c89ef025562161242a7c19b213bd6b272e93df",
              "status": "affected",
              "version": "2039f26f3aca5b0e419b98f65dd36481337b86ee",
              "versionType": "git"
            },
            {
              "lessThan": "e4f4db47794c9f474b184ee1418f42e6a07412b6",
              "status": "affected",
              "version": "2039f26f3aca5b0e419b98f65dd36481337b86ee",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b27bdf02c400684225ee5ee99970bcbf5082282",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.272",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.231",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.166",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.272",
                  "versionStartIncluding": "4.19.207",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.231",
                  "versionStartIncluding": "5.4.146",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.166",
                  "versionStartIncluding": "5.10.56",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.91",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.9",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.13.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix pointer-leak due to insufficient speculative store bypass mitigation\n\nTo mitigate Spectre v4, 2039f26f3aca (\"bpf: Fix leakage due to\ninsufficient speculative store bypass mitigation\") inserts lfence\ninstructions after 1) initializing a stack slot and 2) spilling a\npointer to the stack.\n\nHowever, this does not cover cases where a stack slot is first\ninitialized with a pointer (subject to sanitization) but then\noverwritten with a scalar (not subject to sanitization because\nthe slot was already initialized). In this case, the second write\nmay be subject to speculative store bypass (SSB) creating a\nspeculative pointer-as-scalar type confusion. This allows the\nprogram to subsequently leak the numerical pointer value using,\nfor example, a branch-based cache side channel.\n\nTo fix this, also sanitize scalars if they write a stack slot\nthat previously contained a pointer. Assuming that pointer-spills\nare only generated by LLVM on register-pressure, the performance\nimpact on most real-world BPF programs should be small.\n\nThe following unprivileged BPF bytecode drafts a minimal exploit\nand the mitigation:\n\n  [...]\n  // r6 = 0 or 1 (skalar, unknown user input)\n  // r7 = accessible ptr for side channel\n  // r10 = frame pointer (fp), to be leaked\n  //\n  r9 = r10 # fp alias to encourage ssb\n  *(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked\n  // lfence added here because of pointer spill to stack.\n  //\n  // Ommitted: Dummy bpf_ringbuf_output() here to train alias predictor\n  // for no r9-r10 dependency.\n  //\n  *(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr\n  // 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID,\n  // store may be subject to SSB\n  //\n  // fix: also add an lfence when the slot contained a ptr\n  //\n  r8 = *(u64 *)(r9 - 8)\n  // r8 = architecturally a scalar, speculatively a ptr\n  //\n  // leak ptr using branch-based cache side channel:\n  r8 \u0026= 1 // choose bit to leak\n  if r8 == 0 goto SLOW // no mispredict\n  // architecturally dead code if input r6 is 0,\n  // only executes speculatively iff ptr bit is 1\n  r8 = *(u64 *)(r7 + 0) # encode bit in cache (0: slow, 1: fast)\nSLOW:\n  [...]\n\nAfter running this, the program can time the access to *(r7 + 0) to\ndetermine whether the chosen pointer bit was 0 or 1. Repeat this 64\ntimes to recover the whole address on amd64.\n\nIn summary, sanitization can only be skipped if one scalar is\noverwritten with another scalar. Scalar-confusion due to speculative\nstore bypass can not lead to invalid accesses because the pointer\nbounds deducted during verification are enforced using branchless\nlogic. See 979d63d50c0c (\"bpf: prevent out of bounds speculation on\npointer arithmetic\") for details.\n\nDo not make the mitigation depend on !env-\u003eallow_{uninit_stack,ptr_leaks}\nbecause speculative leaks are likely unexpected if these were enabled.\nFor example, leaking the address to a protected log file may be acceptable\nwhile disabling the mitigation might unintentionally leak the address\ninto the cached-state of a map that is accessible to unprivileged\nprocesses."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T12:50:06.221Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aae109414a57ab4164218f36e2e4a17f027fcaaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/81b3374944d201872cfcf82730a7860f8e7c31dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/da75dec7c6617bddad418159ffebcb133f008262"
        },
        {
          "url": "https://git.kernel.org/stable/c/01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0c89ef025562161242a7c19b213bd6b272e93df"
        },
        {
          "url": "https://git.kernel.org/stable/c/e4f4db47794c9f474b184ee1418f42e6a07412b6"
        }
      ],
      "title": "bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53024",
    "datePublished": "2025-03-27T16:43:49.824Z",
    "dateReserved": "2025-03-27T16:40:15.753Z",
    "dateUpdated": "2025-05-04T12:50:06.221Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2023-53024\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-27T17:15:51.980\",\"lastModified\":\"2025-03-28T18:11:40.180\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix pointer-leak due to insufficient speculative store bypass mitigation\\n\\nTo mitigate Spectre v4, 2039f26f3aca (\\\"bpf: Fix leakage due to\\ninsufficient speculative store bypass mitigation\\\") inserts lfence\\ninstructions after 1) initializing a stack slot and 2) spilling a\\npointer to the stack.\\n\\nHowever, this does not cover cases where a stack slot is first\\ninitialized with a pointer (subject to sanitization) but then\\noverwritten with a scalar (not subject to sanitization because\\nthe slot was already initialized). In this case, the second write\\nmay be subject to speculative store bypass (SSB) creating a\\nspeculative pointer-as-scalar type confusion. This allows the\\nprogram to subsequently leak the numerical pointer value using,\\nfor example, a branch-based cache side channel.\\n\\nTo fix this, also sanitize scalars if they write a stack slot\\nthat previously contained a pointer. Assuming that pointer-spills\\nare only generated by LLVM on register-pressure, the performance\\nimpact on most real-world BPF programs should be small.\\n\\nThe following unprivileged BPF bytecode drafts a minimal exploit\\nand the mitigation:\\n\\n  [...]\\n  // r6 = 0 or 1 (skalar, unknown user input)\\n  // r7 = accessible ptr for side channel\\n  // r10 = frame pointer (fp), to be leaked\\n  //\\n  r9 = r10 # fp alias to encourage ssb\\n  *(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked\\n  // lfence added here because of pointer spill to stack.\\n  //\\n  // Ommitted: Dummy bpf_ringbuf_output() here to train alias predictor\\n  // for no r9-r10 dependency.\\n  //\\n  *(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr\\n  // 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID,\\n  // store may be subject to SSB\\n  //\\n  // fix: also add an lfence when the slot contained a ptr\\n  //\\n  r8 = *(u64 *)(r9 - 8)\\n  // r8 = architecturally a scalar, speculatively a ptr\\n  //\\n  // leak ptr using branch-based cache side channel:\\n  r8 \u0026= 1 // choose bit to leak\\n  if r8 == 0 goto SLOW // no mispredict\\n  // architecturally dead code if input r6 is 0,\\n  // only executes speculatively iff ptr bit is 1\\n  r8 = *(u64 *)(r7 + 0) # encode bit in cache (0: slow, 1: fast)\\nSLOW:\\n  [...]\\n\\nAfter running this, the program can time the access to *(r7 + 0) to\\ndetermine whether the chosen pointer bit was 0 or 1. Repeat this 64\\ntimes to recover the whole address on amd64.\\n\\nIn summary, sanitization can only be skipped if one scalar is\\noverwritten with another scalar. Scalar-confusion due to speculative\\nstore bypass can not lead to invalid accesses because the pointer\\nbounds deducted during verification are enforced using branchless\\nlogic. See 979d63d50c0c (\\\"bpf: prevent out of bounds speculation on\\npointer arithmetic\\\") for details.\\n\\nDo not make the mitigation depend on !env-\u003eallow_{uninit_stack,ptr_leaks}\\nbecause speculative leaks are likely unexpected if these were enabled.\\nFor example, leaking the address to a protected log file may be acceptable\\nwhile disabling the mitigation might unintentionally leak the address\\ninto the cached-state of a map that is accessible to unprivileged\\nprocesses.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/81b3374944d201872cfcf82730a7860f8e7c31dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aae109414a57ab4164218f36e2e4a17f027fcaaa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b0c89ef025562161242a7c19b213bd6b272e93df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/da75dec7c6617bddad418159ffebcb133f008262\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e4f4db47794c9f474b184ee1418f42e6a07412b6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.