CVE-2023-53645

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Make bpf_refcount_acquire fallible for non-owning refs

This patch fixes an incorrect assumption made in the original

bpf_refcount series [0], specifically that the BPF program calling

bpf_refcount_acquire on some node can always guarantee that the node is

alive. In that series, the patch adding failure behavior to rbtree_add

and list_push_{front, back} breaks this assumption for non-owning

references.

Consider the following program:

n = bpf_kptr_xchg(&mapval, NULL);

/* skip error checking */

bpf_spin_lock(&l);

if(bpf_rbtree_add(&t, &n->rb, less)) {

bpf_refcount_acquire(n);

/* Failed to add, do something else with the node */

}

bpf_spin_unlock(&l);

It's incorrect to assume that bpf_refcount_acquire will always succeed in this

scenario. bpf_refcount_acquire is being called in a critical section

here, but the lock being held is associated with rbtree t, which isn't

necessarily the lock assoc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References