CVE-2023-52928

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Skip invalid kfunc call in backtrack_insn

The verifier skips invalid kfunc call in check_kfunc_call(), which

would be captured in fixup_kfunc_call() if such insn is not eliminated

by dead code elimination. However, this can lead to the following

warning in backtrack_insn(), also see [1]:

------------[ cut here ]------------

verifier backtracking bug

WARNING: CPU: 6 PID: 8646 at kernel/bpf/verifier.c:2756 backtrack_insn

kernel/bpf/verifier.c:2756

__mark_chain_precision kernel/bpf/verifier.c:3065

mark_chain_precision kernel/bpf/verifier.c:3165

adjust_reg_min_max_vals kernel/bpf/verifier.c:10715

check_alu_op kernel/bpf/verifier.c:10928

do_check kernel/bpf/verifier.c:13821 [inline]

do_check_common kernel/bpf/verifier.c:16289

[...]

So make backtracking conservative with this by returning ENOTSUPP.

[1] https://lore.kernel.org/bpf/CACkBjsaXNceR8ZjkLG=dT3P=4A8SBsg0Z5h5PWLryF5=ghKq=g@mail.gmail.com/

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References