Vulnerability-Lookup

FKIE_CVE-2023-54303

Vulnerability from fkie_nvd - Published: 2025-12-30 13:16 - Updated: 2026-08-04 11:16

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_perf_event_output The nesting protection in bpf_perf_event_output relies on disabled preemption, which is guaranteed for kprobes and tracepoints. However bpf_perf_event_output can be also called from uprobes context through bpf_prog_run_array_sleepable function which disables migration, but keeps preemption enabled. This can cause task to be preempted by another one inside the nesting protection and lead eventually to two tasks using same perf_sample_data buffer and cause crashes like: kernel tried to execute NX-protected page - exploit attempt? (uid: 0) BUG: unable to handle page fault for address: ffffffff82be3eea ... Call Trace: ? __die+0x1f/0x70 ? page_fault_oops+0x176/0x4d0 ? exc_page_fault+0x132/0x230 ? asm_exc_page_fault+0x22/0x30 ? perf_output_sample+0x12b/0x910 ? perf_event_output+0xd0/0x1d0 ? bpf_perf_event_output+0x162/0x1d0 ? bpf_prog_c6271286d9a4c938_krava1+0x76/0x87 ? __uprobe_perf_func+0x12b/0x540 ? uprobe_dispatcher+0x2c4/0x430 ? uprobe_notify_resume+0x2da/0xce0 ? atomic_notifier_call_chain+0x7b/0x110 ? exit_to_user_mode_prepare+0x13e/0x290 ? irqentry_exit_to_user_mode+0x5/0x30 ? asm_exc_int3+0x35/0x40 Fixing this by disabling preemption in bpf_perf_event_output.

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/3654ed5daf492463c3faa434c7000d45c2da2ace
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a0ac32cf61e5a76e2429e486925a52ee41dd75e3
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/f2c67a3e60d1071b65848efaa8c3b66c363dd025

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/bpf_trace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3654ed5daf492463c3faa434c7000d45c2da2ace",
              "status": "affected",
              "version": "8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9",
              "versionType": "git"
            },
            {
              "lessThan": "a0ac32cf61e5a76e2429e486925a52ee41dd75e3",
              "status": "affected",
              "version": "8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9",
              "versionType": "git"
            },
            {
              "lessThan": "f2c67a3e60d1071b65848efaa8c3b66c363dd025",
              "status": "affected",
              "version": "8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/bpf_trace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disable preemption in bpf_perf_event_output\n\nThe nesting protection in bpf_perf_event_output relies on disabled\npreemption, which is guaranteed for kprobes and tracepoints.\n\nHowever bpf_perf_event_output can be also called from uprobes context\nthrough bpf_prog_run_array_sleepable function which disables migration,\nbut keeps preemption enabled.\n\nThis can cause task to be preempted by another one inside the nesting\nprotection and lead eventually to two tasks using same perf_sample_data\nbuffer and cause crashes like:\n\n  kernel tried to execute NX-protected page - exploit attempt? (uid: 0)\n  BUG: unable to handle page fault for address: ffffffff82be3eea\n  ...\n  Call Trace:\n   ? __die+0x1f/0x70\n   ? page_fault_oops+0x176/0x4d0\n   ? exc_page_fault+0x132/0x230\n   ? asm_exc_page_fault+0x22/0x30\n   ? perf_output_sample+0x12b/0x910\n   ? perf_event_output+0xd0/0x1d0\n   ? bpf_perf_event_output+0x162/0x1d0\n   ? bpf_prog_c6271286d9a4c938_krava1+0x76/0x87\n   ? __uprobe_perf_func+0x12b/0x540\n   ? uprobe_dispatcher+0x2c4/0x430\n   ? uprobe_notify_resume+0x2da/0xce0\n   ? atomic_notifier_call_chain+0x7b/0x110\n   ? exit_to_user_mode_prepare+0x13e/0x290\n   ? irqentry_exit_to_user_mode+0x5/0x30\n   ? asm_exc_int3+0x35/0x40\n\nFixing this by disabling preemption in bpf_perf_event_output."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbpf: Deshabilitar la preferencia en bpf_perf_event_output\n\nLa protecci\u00f3n de anidamiento en bpf_perf_event_output se basa en la preferencia deshabilitada, lo cual est\u00e1 garantizado para kprobes y tracepoints.\n\nSin embargo, bpf_perf_event_output tambi\u00e9n puede ser llamado desde el contexto de uprobes a trav\u00e9s de la funci\u00f3n bpf_prog_run_array_sleepable que deshabilita la migraci\u00f3n, pero mantiene la preferencia habilitada.\n\nEsto puede causar que una tarea sea preferida por otra dentro de la protecci\u00f3n de anidamiento y eventualmente llevar a que dos tareas usen el mismo b\u00fafer perf_sample_data y causen fallos como:\n\n  el kernel intent\u00f3 ejecutar una p\u00e1gina protegida por NX - \u00bfintento de exploit? (uid: 0)\n  BUG: no se puede manejar el fallo de p\u00e1gina para la direcci\u00f3n: ffffffff82be3eea\n  ...\n  Rastro de Llamada:\n   ? __die+0x1f/0x70\n   ? page_fault_oops+0x176/0x4d0\n   ? exc_page_fault+0x132/0x230\n   ? asm_exc_page_fault+0x22/0x30\n   ? perf_output_sample+0x12b/0x910\n   ? perf_event_output+0xd0/0x1d0\n   ? bpf_perf_event_output+0x162/0x1d0\n   ? bpf_prog_c6271286d9a4c938_krava1+0x76/0x87\n   ? __uprobe_perf_func+0x12b/0x540\n   ? uprobe_dispatcher+0x2c4/0x430\n   ? uprobe_notify_resume+0x2da/0xce0\n   ? atomic_notifier_call_chain+0x7b/0x110\n   ? exit_to_user_mode_prepare+0x13e/0x290\n   ? irqentry_exit_to_user_mode+0x5/0x30\n   ? asm_exc_int3+0x35/0x40\n\nEsto se soluciona deshabilitando la preferencia en bpf_perf_event_output."
    }
  ],
  "id": "CVE-2023-54303",
  "lastModified": "2026-08-04T11:16:39.610",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2025-12-30T13:16:19.437",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3654ed5daf492463c3faa434c7000d45c2da2ace"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a0ac32cf61e5a76e2429e486925a52ee41dd75e3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f2c67a3e60d1071b65848efaa8c3b66c363dd025"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Deferred"
}

CVE-2023-54303 (GCVE-0-2023-54303)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:23 – Updated: 2026-08-05 09:19

Title

bpf: Disable preemption in bpf_perf_event_output

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/3654ed5daf492463c…
https://git.kernel.org/stable/c/a0ac32cf61e5a76e2…
https://git.kernel.org/stable/c/f2c67a3e60d1071b6…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9 , < 3654ed5daf492463c3faa434c7000d45c2da2ace (git) Affected: 8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9 , < a0ac32cf61e5a76e2429e486925a52ee41dd75e3 (git) Affected: 8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9 , < f2c67a3e60d1071b65848efaa8c3b66c363dd025 (git)
Linux	Linux	Affected: 6.0 Unaffected: 0 , < 6.0 (semver) Unaffected: 6.1.45 , ≤ 6.1.* (semver) Unaffected: 6.4.10 , ≤ 6.4.* (semver) Unaffected: 6.5 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/bpf_trace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3654ed5daf492463c3faa434c7000d45c2da2ace",
              "status": "affected",
              "version": "8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9",
              "versionType": "git"
            },
            {
              "lessThan": "a0ac32cf61e5a76e2429e486925a52ee41dd75e3",
              "status": "affected",
              "version": "8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9",
              "versionType": "git"
            },
            {
              "lessThan": "f2c67a3e60d1071b65848efaa8c3b66c363dd025",
              "status": "affected",
              "version": "8c7dcb84e3b744b2b70baa7a44a9b1881c33a9c9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/bpf_trace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.0"
            },
            {
              "lessThan": "6.0",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.45",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.10",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "6.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disable preemption in bpf_perf_event_output\n\nThe nesting protection in bpf_perf_event_output relies on disabled\npreemption, which is guaranteed for kprobes and tracepoints.\n\nHowever bpf_perf_event_output can be also called from uprobes context\nthrough bpf_prog_run_array_sleepable function which disables migration,\nbut keeps preemption enabled.\n\nThis can cause task to be preempted by another one inside the nesting\nprotection and lead eventually to two tasks using same perf_sample_data\nbuffer and cause crashes like:\n\n  kernel tried to execute NX-protected page - exploit attempt? (uid: 0)\n  BUG: unable to handle page fault for address: ffffffff82be3eea\n  ...\n  Call Trace:\n   ? __die+0x1f/0x70\n   ? page_fault_oops+0x176/0x4d0\n   ? exc_page_fault+0x132/0x230\n   ? asm_exc_page_fault+0x22/0x30\n   ? perf_output_sample+0x12b/0x910\n   ? perf_event_output+0xd0/0x1d0\n   ? bpf_perf_event_output+0x162/0x1d0\n   ? bpf_prog_c6271286d9a4c938_krava1+0x76/0x87\n   ? __uprobe_perf_func+0x12b/0x540\n   ? uprobe_dispatcher+0x2c4/0x430\n   ? uprobe_notify_resume+0x2da/0xce0\n   ? atomic_notifier_call_chain+0x7b/0x110\n   ? exit_to_user_mode_prepare+0x13e/0x290\n   ? irqentry_exit_to_user_mode+0x5/0x30\n   ? asm_exc_int3+0x35/0x40\n\nFixing this by disabling preemption in bpf_perf_event_output."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is BPF/uprobe tracing infrastructure reached only by executing code on the machine (hitting an instrumented userspace function via local process execution). There is no remote or adjacent-network entry point.\nAC:L - The attacker controls both racing sides \u2014 they run all the threads that hit the uprobe \u2014 and can pin them to a single CPU with sched_setaffinity, widen the window with large bpf_perf_event_output payloads, and rely on full preemption being the default on PREEMPT_DYNAMIC distro and Android kernels. Nothing required is outside attacker influence.\nPR:L - In the realistic worst case \u2014 a host running a system-wide uprobe/USDT observability agent (bpftrace, BCC, continuous profiler), whose programs use perf_submit()/bpf_perf_event_output by default \u2014 any unprivileged local user triggers the corruption merely by executing the instrumented binary concurrently. No capability of the attacker\u0027s own is needed.\nUI:N - The attacker\u0027s own threads hit the uprobe and generate the preemption; no victim action or interaction is required.\nS:U - The corrupted per-CPU perf_sample_data and the resulting code execution are entirely within the kernel\u0027s own security authority, with no crossing into a hypervisor, IOMMU, or other authority.\nC:H - The shared slot leaves data-\u003eraw pointing at another task\u0027s freed/reused kernel stack, so __output_copy() copies frag-\u003esize bytes from an arbitrary frag-\u003edata pointer into the mmapped perf ring buffer, yielding arbitrary kernel memory disclosure.\nI:H - __output_custom() performs an indirect call through frag-\u003ecopy read from a reused kernel stack \u2014 confirmed by the \"kernel tried to execute NX-protected page - exploit attempt?\" oops \u2014 giving an attacker-sprayable control-flow hijack primitive on top of concurrent writes to a shared perf_sample_data.\nA:H - The commit message documents a reproducible kernel page fault / oops in perf_output_sample, and the race can be re-triggered at will to repeatedly panic the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:19:03.573Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3654ed5daf492463c3faa434c7000d45c2da2ace"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0ac32cf61e5a76e2429e486925a52ee41dd75e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2c67a3e60d1071b65848efaa8c3b66c363dd025"
        }
      ],
      "title": "bpf: Disable preemption in bpf_perf_event_output",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54303",
    "datePublished": "2025-12-30T12:23:37.827Z",
    "dateReserved": "2025-12-30T12:06:44.529Z",
    "dateUpdated": "2026-08-05T09:19:03.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.