Linux kernel perf: BPF event output writes past a small on-stack structure, corrupting kernel stack memory

CVSS 7.8CVE-2023-53065Kernel, userspace & hypervisorcurated

Impact

perf_event_bpf_output passed a small struct where perf_output_begin expected a full perf_sample_data, so the header init path wrote beyond the caller's on-stack buffer - caught by KASAN as a stack out-of-bounds. Kernel stack corruption from a reachable code path is a candidate for local privilege escalation and a reliable way to panic the host. The trigger is BPF program load/unload while a side-band perf event is active, which is routine on GPU nodes running continuous profilers or eBPF-based observability agents alongside tenant jobs; a crash here takes the whole node and every co-located job down.

Who can reach it

Local, authenticated: requires the ability to open perf events (perf_event_paranoid permitting, or CAP_PERFMON) at the same time as BPF program load/teardown. Both are usually operator-side agents rather than tenant pods, but a pod granted perf or BPF privileges can reach it.

What to do

Update to a fixed stable kernel (commits in the record) and reboot the node - drain and reboot per host. As an interim step, tighten kernel.perf_event_paranoid and confirm no tenant workload holds CAP_PERFMON or CAP_BPF.

References

https://nvd.nist.gov/vuln/detail/CVE-2023-53065 https://git.kernel.org/stable/c/ff8137727a2af4ad5f6e6c8b9f7ec5e8db9da86c https://git.kernel.org/stable/c/eb81a2ed4f52be831c9fb879752d89645a312c13

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.