Linux kernel BPF verifier (stack depth tracking for variable-offset writes): check_mem_access() passed only the fixed

CVSS 7.8CVE-2023-52452Kernel, userspace & hypervisorcurated

Impact

check_mem_access() passed only the fixed part of an offset register to the stack-depth accounting, ignoring the variable part, so a program whose writes used a variable offset could verify while the kernel allocated a stack smaller than the program actually needs. The program then reads out of bounds at run time - a kernel memory disclosure or corruption that the verifier was supposed to make impossible. The same patch also makes privileged reads of uninitialized stack slots behave consistently. On GPU nodes the exposure is whatever is allowed to load BPF: the CNI, the node agents, the metrics exporters.

Who can reach it

Local user able to load BPF programs, which means CAP_BPF/CAP_SYS_ADMIN or root; the inconsistency fixed here concerns privileged programs specifically. An unprivileged tenant without BPF access cannot reach it.

What to do

Move to a kernel with the fix (four stable commits are listed) and reboot each node to run it. No runtime toggle exists; restricting who may load BPF programs is the only interim step. Treat it as a rolling drain and reboot alongside the other BPF verifier fixes rather than a window of its own.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-52452 https://git.kernel.org/stable/c/fbcf372c8eda2290470268e0afb5ab5d5f5d5fde https://git.kernel.org/stable/c/6b4a64bafd107e521c01eec3453ce94a3fb38529

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.