CVE-2023-52920

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: support non-r10 register spill/fill to/from stack in precision tracking

Use instruction (jump) history to record instructions that performed

register spill/fill to/from stack, regardless if this was done through

read-only r10 register, or any other register after copying r10 into it

*and* potentially adjusting offset.

To make this work reliably, we push extra per-instruction flags into

instruction history, encoding stack slot index (spi) and stack frame

number in extra 10 bit flags we take away from prev_idx in instruction

history. We don't touch idx field for maximum performance, as it's

checked most frequently during backtracking.

This change removes basically the last remaining practical limitation of

precision backtracking logic in BPF verifier. It fixes known

deficiencies, but also opens up new opportunities to reduce number of

verified states, explored in the subsequent patches.

There are only three dif

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References