180 lines
9.3 KiB
JSON
180 lines
9.3 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2023-54086",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-12-24T13:02:52.515Z",
|
|
"datePublished": "2025-12-24T13:06:16.857Z",
|
|
"dateUpdated": "2026-05-23T15:32:32.011Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-05-23T15:32:32.011Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Add preempt_count_{sub,add} into btf id deny list\n\nThe recursion check in __bpf_prog_enter* and __bpf_prog_exit*\nleave preempt_count_{sub,add} unprotected. When attaching trampoline to\nthem we get panic as follows,\n\n[ 867.843050] BUG: TASK stack guard page was hit at 0000000009d325cf (stack is 0000000046a46a15..00000000537e7b28)\n[ 867.843064] stack guard page: 0000 [#1] PREEMPT SMP NOPTI\n[ 867.843067] CPU: 8 PID: 11009 Comm: trace Kdump: loaded Not tainted 6.2.0+ #4\n[ 867.843100] Call Trace:\n[ 867.843101] <TASK>\n[ 867.843104] asm_exc_int3+0x3a/0x40\n[ 867.843108] RIP: 0010:preempt_count_sub+0x1/0xa0\n[ 867.843135] __bpf_prog_enter_recur+0x17/0x90\n[ 867.843148] bpf_trampoline_6442468108_0+0x2e/0x1000\n[ 867.843154] ? preempt_count_sub+0x1/0xa0\n[ 867.843157] preempt_count_sub+0x5/0xa0\n[ 867.843159] ? migrate_enable+0xac/0xf0\n[ 867.843164] __bpf_prog_exit_recur+0x2d/0x40\n[ 867.843168] bpf_trampoline_6442468108_0+0x55/0x1000\n...\n[ 867.843788] preempt_count_sub+0x5/0xa0\n[ 867.843793] ? migrate_enable+0xac/0xf0\n[ 867.843829] __bpf_prog_exit_recur+0x2d/0x40\n[ 867.843837] BUG: IRQ stack guard page was hit at 0000000099bd8228 (stack is 00000000b23e2bc4..000000006d95af35)\n[ 867.843841] BUG: IRQ stack guard page was hit at 000000005ae07924 (stack is 00000000ffd69623..0000000014eb594c)\n[ 867.843843] BUG: IRQ stack guard page was hit at 00000000028320f0 (stack is 00000000034b6438..0000000078d1bcec)\n[ 867.843842] bpf_trampoline_6442468108_0+0x55/0x1000\n...\n\nThat is because in __bpf_prog_exit_recur, the preempt_count_{sub,add} are\ncalled after prog->active is decreased.\n\nFixing this by adding these two functions into btf ids deny list."
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"kernel/bpf/verifier.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "35e3815fa8102fab4dee75f3547472c66581125d",
|
|
"lessThan": "095018267c87b8bfbbb12eeb1c0ebf2359e1782c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "35e3815fa8102fab4dee75f3547472c66581125d",
|
|
"lessThan": "60039bf72f81638baa28652a11a68e9b0b7b5b2d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "35e3815fa8102fab4dee75f3547472c66581125d",
|
|
"lessThan": "b9168d41b83d182f34ba927ee822edaee18d5fc8",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "35e3815fa8102fab4dee75f3547472c66581125d",
|
|
"lessThan": "c11bd046485d7bf1ca200db0e7d0bdc4bafdd395",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f5e770c0c60ab8812574a2e0d163b0efa816a825",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "5.12.11",
|
|
"lessThan": "5.13",
|
|
"status": "affected",
|
|
"versionType": "semver"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"kernel/bpf/verifier.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.13",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.13",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.113",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.30",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.3.4",
|
|
"lessThanOrEqual": "6.3.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.4",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.13",
|
|
"versionEndExcluding": "5.15.113"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.13",
|
|
"versionEndExcluding": "6.1.30"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.13",
|
|
"versionEndExcluding": "6.3.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.13",
|
|
"versionEndExcluding": "6.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.12.11"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/095018267c87b8bfbbb12eeb1c0ebf2359e1782c"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/60039bf72f81638baa28652a11a68e9b0b7b5b2d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b9168d41b83d182f34ba927ee822edaee18d5fc8"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/c11bd046485d7bf1ca200db0e7d0bdc4bafdd395"
|
|
}
|
|
],
|
|
"title": "bpf: Add preempt_count_{sub,add} into btf id deny list",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |