CVE-2023-52452

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix accesses to uninit stack slots

Privileged programs are supposed to be able to read uninitialized stack

memory (ever since 6715df8d5) but, before this patch, these accesses

were permitted inconsistently. In particular, accesses were permitted

above state->allocated_stack, but not below it. In other words, if the

stack was already "large enough", the access was permitted, but

otherwise the access was rejected instead of being allowed to "grow the

stack". This undesired rejection was happening in two places:

- in check_stack_slot_within_bounds()

- in check_stack_range_initialized()

This patch arranges for these accesses to be permitted. A bunch of tests

that were relying on the old rejection had to change; all of them were

changed to add also run unprivileged, in which case the old behavior

persists. One tests couldn't be updated - global_func16 - because it

can't run unprivileged for other reasons.

This patch

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References