CVE-2023-54303
Description
A flaw was found in the Linux kernel's BPF subsystem. The bpf_perf_event_output() function relies on disabled preemption for nesting protection, but when called from uprobes context via bpf_prog_run_array_sleepable(), preemption remains enabled. This allows task preemption during protected sections, leading to buffer corruption when two tasks share the same perf_sample_data buffer, causing kernel crashes.
Statement
This issue requires BPF programs attached to uprobes that use bpf_perf_event_output(). The flaw can cause kernel crashes when specific preemption timing occurs, but exploiting it for more than denial of service would require precise control over kernel scheduling. Loading BPF programs typically requires CAP_BPF or CAP_SYS_ADMIN capabilities.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Alter Execution Logic; Unexpected State
The main problem is that -- if a lock is overcome -- data could be altered in a bad state.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
