Linux kernel BPF verifier: missing precision marking lets an out-of-bounds ringbuf access pass

Impact

The verifier failed to propagate precision markers for ARG_CONST_ALLOC_SIZE_OR_ZERO arguments, so it could prune two states as equivalent when the constant that sets the returned PTR_TO_MEM size differed. A program that the verifier should reject - writing beyond the size actually reserved by bpf_ringbuf_reserve - can be accepted, giving an out-of-bounds kernel write or read. Reachable only by a loader that can get imprecise scalars, which means a privileged user holding CAP_BPF; without CAP_BPF the kernel marks registers precise unconditionally. On a GPU node that means a CAP_BPF-holding agent or privileged pod can escalate to corrupting kernel memory on a host shared with other tenants.

Who can reach it

Local user or container with CAP_BPF able to load its own BPF programs. Not reachable without BPF load privileges and not remote.

What to do

Run a kernel with the stable fix that calls mark_chain_precision for these arguments and reboot each node; this is an old fix, so most maintained kernels already carry it - confirm your running version rather than scheduling a window blindly. Mitigation in the meantime is to withdraw CAP_BPF from workloads.

References

Related entries

• Linux kernel bpf/cgroup: BUG() in purge_effective_progs on detach after allocation failureCVE-2022-49970 · Linux kernel bpf cgroup (purge_effective_progs)High
• Linux kernel cpuset: attaching a task to a cgroup v2 cpuset with an empty cpus_allowed panics the hostCVE-2022-50103 · Linux kernel cpuset/deadline scheduler (task_can_attach, dl_cpu_busy)High
• Linux kernel (drivers/vfio/pci/hisilicon): The VFIO migration save and resume paths do not advance the data pointer byCVE-2023-52453 · Linux kernel (drivers/vfio/pci/hisilicon)High
• Linux kernel BPF verifier: missing Spectre v4 sanitization leaks kernel pointers to unprivileged BPFCVE-2023-53024 · Linux kernel BPF verifier (speculative store bypass sanitization of stack slots)High
• Linux kernel scsi/ses: out-of-bounds desc_ptr accesses while parsing enclosure dataCVE-2023-53675 · Linux kernel scsi: ses (enclosure descriptor parsing)High
• Linux kernel arm64: negative length in IP checksum code causes out-of-bounds readCVE-2023-53726 · Linux kernel arm64 csum (do_csum negative length handling)High