CVE-2023-52676 (GCVE-0-2023-52676)
Vulnerability from cvelistv5
Published
2024-05-17 14:24
Modified
2026-08-05 09:10
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Guard stack limits against 32bit overflow This patch promotes the arithmetic around checking stack bounds to be done in the 64-bit domain, instead of the current 32bit. The arithmetic implies adding together a 64-bit register with a int offset. The register was checked to be below 1<<29 when it was variable, but not when it was fixed. The offset either comes from an instruction (in which case it is 16 bit), from another register (in which case the caller checked it to be below 1<<29 [1]), or from the size of an argument to a kfunc (in which case it can be a u32 [2]). Between the register being inconsistently checked to be below 1<<29, and the offset being up to an u32, it appears that we were open to overflowing the `int`s which were currently used for arithmetic. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498 [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904
References
Impacted products
Vendor Product Version
Linux Linux Version: 01f810ace9ed37255f27608a0864abebccf0aab3
Version: 01f810ace9ed37255f27608a0864abebccf0aab3
Version: 01f810ace9ed37255f27608a0864abebccf0aab3
Version: f3c4b01689d392373301e6e60d1b02c5b4020afc
Version: d1b725ea5d104caea250427899f4e2e3ab15b4fc
Version: 5.10.33   ≤
Version: 5.11.17   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52676",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T15:14:32.563852Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T15:14:46.799Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:11:34.390Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ad140fc856f0b1d5e2215bcb6d0cc247a86805a2",
              "status": "affected",
              "version": "01f810ace9ed37255f27608a0864abebccf0aab3",
              "versionType": "git"
            },
            {
              "lessThan": "e5ad9ecb84405637df82732ee02ad741a5f782a6",
              "status": "affected",
              "version": "01f810ace9ed37255f27608a0864abebccf0aab3",
              "versionType": "git"
            },
            {
              "lessThan": "1d38a9ee81570c4bd61f557832dead4d6f816760",
              "status": "affected",
              "version": "01f810ace9ed37255f27608a0864abebccf0aab3",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "f3c4b01689d392373301e6e60d1b02c5b4020afc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d1b725ea5d104caea250427899f4e2e3ab15b4fc",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.33",
              "versionType": "semver"
            },
            {
              "lessThan": "5.12",
              "status": "affected",
              "version": "5.11.17",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/verifier.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "lessThan": "5.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.14",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.2",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "5.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.11.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard stack limits against 32bit overflow\n\nThis patch promotes the arithmetic around checking stack bounds to be\ndone in the 64-bit domain, instead of the current 32bit. The arithmetic\nimplies adding together a 64-bit register with a int offset. The\nregister was checked to be below 1\u003c\u003c29 when it was variable, but not\nwhen it was fixed. The offset either comes from an instruction (in which\ncase it is 16 bit), from another register (in which case the caller\nchecked it to be below 1\u003c\u003c29 [1]), or from the size of an argument to a\nkfunc (in which case it can be a u32 [2]). Between the register being\ninconsistently checked to be below 1\u003c\u003c29, and the offset being up to an\nu32, it appears that we were open to overflowing the `int`s which were\ncurrently used for arithmetic.\n\n[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498\n[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the BPF verifier\u0027s stack bounds checking during bpf(BPF_PROG_LOAD); it is reached only via a local syscall, not via network packet processing.\nAC:L - An attacker fully controls the submitted BPF bytecode and offsets/sizes that feed the overflowing int arithmetic, so the bad bounds calculation can be triggered reliably with no conditions outside attacker control.\nPR:L - The vulnerable const stack-bounds path runs for ordinary stack accesses during program load, including for unprivileged SOCKET_FILTER/CGROUP_SKB when unprivileged BPF is enabled; CAP_BPF is not required for all reachability paths.\nUI:N - Exploitation requires only calling bpf() with a crafted program; no victim interaction is needed.\nS:U - Impact stays within the host kernel authority (verifier memory corruption and/or local privilege escalation); this is not a VM/IOMMU/guest-to-host boundary crossing.\nC:H - Integer overflow can bypass stack bounds checks and lead to out-of-bounds accesses of verifier stack-slot state and/or runtime BPF stack, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same overflow enables out-of-bounds writes in verifier tracking and/or a verifier bypass allowing corrupted BPF stack accesses at runtime, which is exploitable for control-flow hijacking and privilege escalation.\nA:H - Failed bounds math has caused out-of-bounds accesses and kernel oopses in check_stack_range_initialized() during verification, so availability impact is a full kernel crash."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:10:58.656Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760"
        }
      ],
      "title": "bpf: Guard stack limits against 32bit overflow",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52676",
    "datePublished": "2024-05-17T14:24:41.387Z",
    "dateReserved": "2024-03-07T14:49:46.886Z",
    "dateUpdated": "2026-08-05T09:10:58.656Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T23:11:34.390Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2023-52676\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-12T15:14:32.563852Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-12T15:14:42.452Z\"}}], \"cna\": {\"title\": \"bpf: Guard stack limits against 32bit overflow\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The bug is in the BPF verifier\u0027s stack bounds checking during bpf(BPF_PROG_LOAD); it is reached only via a local syscall, not via network packet processing.\\nAC:L - An attacker fully controls the submitted BPF bytecode and offsets/sizes that feed the overflowing int arithmetic, so the bad bounds calculation can be triggered reliably with no conditions outside attacker control.\\nPR:L - The vulnerable const stack-bounds path runs for ordinary stack accesses during program load, including for unprivileged SOCKET_FILTER/CGROUP_SKB when unprivileged BPF is enabled; CAP_BPF is not required for all reachability paths.\\nUI:N - Exploitation requires only calling bpf() with a crafted program; no victim interaction is needed.\\nS:U - Impact stays within the host kernel authority (verifier memory corruption and/or local privilege escalation); this is not a VM/IOMMU/guest-to-host boundary crossing.\\nC:H - Integer overflow can bypass stack bounds checks and lead to out-of-bounds accesses of verifier stack-slot state and/or runtime BPF stack, which can be leveraged for arbitrary kernel memory disclosure.\\nI:H - The same overflow enables out-of-bounds writes in verifier tracking and/or a verifier bypass allowing corrupted BPF stack accesses at runtime, which is exploitable for control-flow hijacking and privilege escalation.\\nA:H - Failed bounds math has caused out-of-bounds accesses and kernel oopses in check_stack_range_initialized() during verification, so availability impact is a full kernel crash.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"01f810ace9ed37255f27608a0864abebccf0aab3\", \"lessThan\": \"ad140fc856f0b1d5e2215bcb6d0cc247a86805a2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"01f810ace9ed37255f27608a0864abebccf0aab3\", \"lessThan\": \"e5ad9ecb84405637df82732ee02ad741a5f782a6\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"01f810ace9ed37255f27608a0864abebccf0aab3\", \"lessThan\": \"1d38a9ee81570c4bd61f557832dead4d6f816760\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3c4b01689d392373301e6e60d1b02c5b4020afc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"d1b725ea5d104caea250427899f4e2e3ab15b4fc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"5.10.33\", \"lessThan\": \"5.11\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"5.11.17\", \"lessThan\": \"5.12\", \"versionType\": \"semver\"}], \"programFiles\": [\"kernel/bpf/verifier.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.12\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.12\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.14\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.7.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.7.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/bpf/verifier.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2\"}, {\"url\": \"https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6\"}, {\"url\": \"https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Guard stack limits against 32bit overflow\\n\\nThis patch promotes the arithmetic around checking stack bounds to be\\ndone in the 64-bit domain, instead of the current 32bit. The arithmetic\\nimplies adding together a 64-bit register with a int offset. The\\nregister was checked to be below 1\u003c\u003c29 when it was variable, but not\\nwhen it was fixed. The offset either comes from an instruction (in which\\ncase it is 16 bit), from another register (in which case the caller\\nchecked it to be below 1\u003c\u003c29 [1]), or from the size of an argument to a\\nkfunc (in which case it can be a u32 [2]). Between the register being\\ninconsistently checked to be below 1\u003c\u003c29, and the offset being up to an\\nu32, it appears that we were open to overflowing the `int`s which were\\ncurrently used for arithmetic.\\n\\n[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498\\n[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.14\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.7.2\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8\", \"versionStartIncluding\": \"5.12\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.10.33\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionStartIncluding\": \"5.11.17\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T09:10:58.656Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2023-52676\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T09:10:58.656Z\", \"dateReserved\": \"2024-03-07T14:49:46.886Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-05-17T14:24:41.387Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.