CVE-2023-52828

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Detect IP == ksym.end as part of BPF program

Now that bpf_throw kfunc is the first such call instruction that has

noreturn semantics within the verifier, this also kicks in dead code

elimination in unprecedented ways. For one, any instruction following

a bpf_throw call will never be marked as seen. Moreover, if a callchain

ends up throwing, any instructions after the call instruction to the

eventually throwing subprog in callers will also never be marked as

seen.

The tempting way to fix this would be to emit extra 'int3' instructions

which bump the jited_len of a program, and ensure that during runtime

when a program throws, we can discover its boundaries even if the call

instruction to bpf_throw (or to subprogs that always throw) is emitted

as the final instruction in the program.

An example of such a program would be this:

do_something():

...

r0 = 0

exit

foo():

r1 = 0

call bpf_throw

r0 = 0

exit

bar

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References