Linux kernel BPF verifier: stack bound arithmetic done in 32 bits could overflow

CVSS 5.5CVE-2023-52676Kernel, userspace & hypervisorcurated

Impact

Stack-bounds checks in the BPF verifier were computed with int arithmetic while the offset could come from a kfunc argument as a u32 and the base register was only bounds-checked when variable, not when fixed. The overflow lets the verifier's stack accounting be wrong, which is a memory-safety exposure in the component whose entire job is proving a program safe before it runs in the kernel. The fix promotes the arithmetic to 64 bits. On GPU nodes this matters because the BPF path is not exotic: CNI dataplanes, observability agents and security tooling load BPF continuously, and any tenant or agent that can reach bpf() with the right privileges reaches the verifier. NVD rates the outcome as availability only. Remediating means rebooting the node, which on a GPU host is a drain, a rescheduled allocation and interrupted long-running jobs.

Who can reach it

A local process able to load BPF programs - CAP_BPF/CAP_SYS_ADMIN, or an unprivileged user if unprivileged BPF is enabled. Not reachable from the network, and not reachable at all on a node where BPF loading is restricted to trusted components.

What to do

Take the stable kernel containing commit e160b2ed94a2 (and its backports) from your distribution and reboot each node, which on a GPU host means drain, reschedule and reboot. Cheaper interim control: set kernel.unprivileged_bpf_disabled=1 and keep BPF loading limited to trusted CNI and observability components.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-52676 https://git.kernel.org/stable/c/e160b2ed94a20fa940369ebd914277f88005e70d https://git.kernel.org/stable/c/4ba97610399e83d29d1086a0827d33172539b49b

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.