CVE-2023-53634

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, arm64: Fixed a BTI error on returning to patched function

When BPF_TRAMP_F_CALL_ORIG is set, BPF trampoline uses BLR to jump

back to the instruction next to call site to call the patched function.

For BTI-enabled kernel, the instruction next to call site is usually

PACIASP, in this case, it's safe to jump back with BLR. But when

the call site is not followed by a PACIASP or bti, a BTI exception

is triggered.

Here is a fault log:

Unhandled 64-bit el1h sync exception on CPU0, ESR 0x0000000034000002 -- BTI

CPU: 0 PID: 263 Comm: test_progs Tainted: GF

Hardware name: linux,dummy-virt (DT)

pstate: 40400805 (nZcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=-c)

pc : bpf_fentry_test1+0xc/0x30

lr : bpf_trampoline_6442573892_0+0x48/0x1000

sp : ffff80000c0c3a50

x29: ffff80000c0c3a90 x28: ffff0000c2e6c080 x27: 0000000000000000

x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000050

x23: 0000000000000000 x22: 0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References