CVE-2023-53221 (GCVE-0-2023-53221)
Vulnerability from cvelistv5
Published
2025-09-15 14:21
Modified
2025-09-15 14:21
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix memleak due to fentry attach failure
If it fails to attach fentry, the allocated bpf trampoline image will be
left in the system. That can be verified by checking /proc/kallsyms.
This meamleak can be verified by a simple bpf program as follows:
SEC("fentry/trap_init")
int fentry_run()
{
return 0;
}
It will fail to attach trap_init because this function is freed after
kernel init, and then we can find the trampoline image is left in the
system by checking /proc/kallsyms.
$ tail /proc/kallsyms
ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf]
ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf]
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'"
[2522] FUNC 'trap_init' type_id=119 linkage=static
$ echo $((6442453466 & 0x7fffffff))
2522
Note that there are two left bpf trampoline images, that is because the
libbpf will fallback to raw tracepoint if -EINVAL is returned.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| ▼ | Linux | Linux |
Version: e21aa341785c679dd409c8cb71f864c00fe6c463 Version: e21aa341785c679dd409c8cb71f864c00fe6c463 Version: e21aa341785c679dd409c8cb71f864c00fe6c463 Version: e21aa341785c679dd409c8cb71f864c00fe6c463 Version: e21d2b92354b3cd25dd774ebb0f0e52ff04a7861 Version: 85d177f56e5256e14b74a65940f981f6e3e8bb32 |
||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/trampoline.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "20109ddd5bea2c24d790debf5d02584ef24c3f5e",
"status": "affected",
"version": "e21aa341785c679dd409c8cb71f864c00fe6c463",
"versionType": "git"
},
{
"lessThan": "f72c67d1a82dada7d6d504c806e111e913721a30",
"status": "affected",
"version": "e21aa341785c679dd409c8cb71f864c00fe6c463",
"versionType": "git"
},
{
"lessThan": "6aa27775db63ba8c7c73891c7dfb71ddc230c48d",
"status": "affected",
"version": "e21aa341785c679dd409c8cb71f864c00fe6c463",
"versionType": "git"
},
{
"lessThan": "108598c39eefbedc9882273ac0df96127a629220",
"status": "affected",
"version": "e21aa341785c679dd409c8cb71f864c00fe6c463",
"versionType": "git"
},
{
"status": "affected",
"version": "e21d2b92354b3cd25dd774ebb0f0e52ff04a7861",
"versionType": "git"
},
{
"status": "affected",
"version": "85d177f56e5256e14b74a65940f981f6e3e8bb32",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/trampoline.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.39",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.13",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.4",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.11.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix memleak due to fentry attach failure\n\nIf it fails to attach fentry, the allocated bpf trampoline image will be\nleft in the system. That can be verified by checking /proc/kallsyms.\n\nThis meamleak can be verified by a simple bpf program as follows:\n\n SEC(\"fentry/trap_init\")\n int fentry_run()\n {\n return 0;\n }\n\nIt will fail to attach trap_init because this function is freed after\nkernel init, and then we can find the trampoline image is left in the\nsystem by checking /proc/kallsyms.\n\n $ tail /proc/kallsyms\n ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf]\n ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf]\n\n $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep \"FUNC \u0027trap_init\u0027\"\n [2522] FUNC \u0027trap_init\u0027 type_id=119 linkage=static\n\n $ echo $((6442453466 \u0026 0x7fffffff))\n 2522\n\nNote that there are two left bpf trampoline images, that is because the\nlibbpf will fallback to raw tracepoint if -EINVAL is returned."
}
],
"providerMetadata": {
"dateUpdated": "2025-09-15T14:21:50.053Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/20109ddd5bea2c24d790debf5d02584ef24c3f5e"
},
{
"url": "https://git.kernel.org/stable/c/f72c67d1a82dada7d6d504c806e111e913721a30"
},
{
"url": "https://git.kernel.org/stable/c/6aa27775db63ba8c7c73891c7dfb71ddc230c48d"
},
{
"url": "https://git.kernel.org/stable/c/108598c39eefbedc9882273ac0df96127a629220"
}
],
"title": "bpf: Fix memleak due to fentry attach failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53221",
"datePublished": "2025-09-15T14:21:50.053Z",
"dateReserved": "2025-09-15T14:19:21.845Z",
"dateUpdated": "2025-09-15T14:21:50.053Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-53221\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-15T15:15:48.873\",\"lastModified\":\"2025-09-15T15:22:27.090\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix memleak due to fentry attach failure\\n\\nIf it fails to attach fentry, the allocated bpf trampoline image will be\\nleft in the system. That can be verified by checking /proc/kallsyms.\\n\\nThis meamleak can be verified by a simple bpf program as follows:\\n\\n SEC(\\\"fentry/trap_init\\\")\\n int fentry_run()\\n {\\n return 0;\\n }\\n\\nIt will fail to attach trap_init because this function is freed after\\nkernel init, and then we can find the trampoline image is left in the\\nsystem by checking /proc/kallsyms.\\n\\n $ tail /proc/kallsyms\\n ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf]\\n ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf]\\n\\n $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep \\\"FUNC \u0027trap_init\u0027\\\"\\n [2522] FUNC \u0027trap_init\u0027 type_id=119 linkage=static\\n\\n $ echo $((6442453466 \u0026 0x7fffffff))\\n 2522\\n\\nNote that there are two left bpf trampoline images, that is because the\\nlibbpf will fallback to raw tracepoint if -EINVAL is returned.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/108598c39eefbedc9882273ac0df96127a629220\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/20109ddd5bea2c24d790debf5d02584ef24c3f5e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6aa27775db63ba8c7c73891c7dfb71ddc230c48d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f72c67d1a82dada7d6d504c806e111e913721a30\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}