CVE-2023-54247

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Silence a warning in btf_type_id_size()

syzbot reported a warning in [1] with the following stacktrace:

WARNING: CPU: 0 PID: 5005 at kernel/bpf/btf.c:1988 btf_type_id_size+0x2d9/0x9d0 kernel/bpf/btf.c:1988

...

RIP: 0010:btf_type_id_size+0x2d9/0x9d0 kernel/bpf/btf.c:1988

...

Call Trace:

<TASK>

map_check_btf kernel/bpf/syscall.c:1024 [inline]

map_create+0x1157/0x1860 kernel/bpf/syscall.c:1198

__sys_bpf+0x127f/0x5420 kernel/bpf/syscall.c:5040

__do_sys_bpf kernel/bpf/syscall.c:5162 [inline]

__se_sys_bpf kernel/bpf/syscall.c:5160 [inline]

__x64_sys_bpf+0x79/0xc0 kernel/bpf/syscall.c:5160

do_syscall_x64 arch/x86/entry/common.c:50 [inline]

do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80

entry_SYSCALL_64_after_hwframe+0x63/0xcd

With the following btf

[1] DECL_TAG 'a' type_id=4 component_idx=-1

[2] PTR '(anon)' type_id=0

[3] TYPE_TAG 'a' type_id=2

[4] VAR 'a' type_id=3,

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References