CVE-2023-54173 (GCVE-0-2023-54173)
Vulnerability from cvelistv5
Published
2025-12-30 12:08
Modified
2026-08-05 09:17
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_event_output We received report [1] of kernel crash, which is caused by using nesting protection without disabled preemption. The bpf_event_output can be called by programs executed by bpf_prog_run_array_cg function that disabled migration but keeps preemption enabled. This can cause task to be preempted by another one inside the nesting protection and lead eventually to two tasks using same perf_sample_data buffer and cause crashes like: BUG: kernel NULL pointer dereference, address: 0000000000000001 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page ... ? perf_output_sample+0x12a/0x9a0 ? finish_task_switch.isra.0+0x81/0x280 ? perf_event_output+0x66/0xa0 ? bpf_event_output+0x13a/0x190 ? bpf_event_output_data+0x22/0x40 ? bpf_prog_dfc84bbde731b257_cil_sock4_connect+0x40a/0xacb ? xa_load+0x87/0xe0 ? __cgroup_bpf_run_filter_sock_addr+0xc1/0x1a0 ? release_sock+0x3e/0x90 ? sk_setsockopt+0x1a1/0x12f0 ? udp_pre_connect+0x36/0x50 ? inet_dgram_connect+0x93/0xa0 ? __sys_connect+0xb4/0xe0 ? udp_setsockopt+0x27/0x40 ? __pfx_udp_push_pending_frames+0x10/0x10 ? __sys_setsockopt+0xdf/0x1a0 ? __x64_sys_connect+0xf/0x20 ? do_syscall_64+0x3a/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc Fixing this by disabling preemption in bpf_event_output. [1] https://github.com/cilium/cilium/issues/26756
References
Impacted products
Vendor Product Version
Linux Linux Version: 2a916f2f546ca1c1e3323e2a4269307f6d9890eb
Version: 2a916f2f546ca1c1e3323e2a4269307f6d9890eb
Version: 2a916f2f546ca1c1e3323e2a4269307f6d9890eb
Version: 2a916f2f546ca1c1e3323e2a4269307f6d9890eb
Version: 2a916f2f546ca1c1e3323e2a4269307f6d9890eb
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/bpf_trace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3048cb0dc0cc9dc74ed93690dffef00733bcad5b",
              "status": "affected",
              "version": "2a916f2f546ca1c1e3323e2a4269307f6d9890eb",
              "versionType": "git"
            },
            {
              "lessThan": "c81bdf8f9f2b002d217c3d5357cdea9f2b82ff90",
              "status": "affected",
              "version": "2a916f2f546ca1c1e3323e2a4269307f6d9890eb",
              "versionType": "git"
            },
            {
              "lessThan": "36dd8ca330b76585640ed32255a3c99f901e1502",
              "status": "affected",
              "version": "2a916f2f546ca1c1e3323e2a4269307f6d9890eb",
              "versionType": "git"
            },
            {
              "lessThan": "063c9ce8e74e07bf94f99cd13146f42867875e8b",
              "status": "affected",
              "version": "2a916f2f546ca1c1e3323e2a4269307f6d9890eb",
              "versionType": "git"
            },
            {
              "lessThan": "d62cc390c2e99ae267ffe4b8d7e2e08b6c758c32",
              "status": "affected",
              "version": "2a916f2f546ca1c1e3323e2a4269307f6d9890eb",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/bpf_trace.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.126",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.190",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.126",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.45",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.10",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disable preemption in bpf_event_output\n\nWe received report [1] of kernel crash, which is caused by\nusing nesting protection without disabled preemption.\n\nThe bpf_event_output can be called by programs executed by\nbpf_prog_run_array_cg function that disabled migration but\nkeeps preemption enabled.\n\nThis can cause task to be preempted by another one inside the\nnesting protection and lead eventually to two tasks using same\nperf_sample_data buffer and cause crashes like:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000001\n  #PF: supervisor instruction fetch in kernel mode\n  #PF: error_code(0x0010) - not-present page\n  ...\n  ? perf_output_sample+0x12a/0x9a0\n  ? finish_task_switch.isra.0+0x81/0x280\n  ? perf_event_output+0x66/0xa0\n  ? bpf_event_output+0x13a/0x190\n  ? bpf_event_output_data+0x22/0x40\n  ? bpf_prog_dfc84bbde731b257_cil_sock4_connect+0x40a/0xacb\n  ? xa_load+0x87/0xe0\n  ? __cgroup_bpf_run_filter_sock_addr+0xc1/0x1a0\n  ? release_sock+0x3e/0x90\n  ? sk_setsockopt+0x1a1/0x12f0\n  ? udp_pre_connect+0x36/0x50\n  ? inet_dgram_connect+0x93/0xa0\n  ? __sys_connect+0xb4/0xe0\n  ? udp_setsockopt+0x27/0x40\n  ? __pfx_udp_push_pending_frames+0x10/0x10\n  ? __sys_setsockopt+0xdf/0x1a0\n  ? __x64_sys_connect+0xf/0x20\n  ? do_syscall_64+0x3a/0x90\n  ? entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nFixing this by disabling preemption in bpf_event_output.\n\n[1] https://github.com/cilium/cilium/issues/26756"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable window is entered from local syscalls (connect/sendmsg/setsockopt/close) that invoke cgroup BPF programs via bpf_prog_run_array_cg in preemptible process context. Remote packets only reach this code through softirq paths where preemption is already disabled, so exploitation requires local execution.\nAC:L - The attacker controls both sides of the race \u2014 multiple threads pinned to the same CPU repeatedly invoking the helper, plus self-generated scheduling pressure to force preemption inside the unprotected nest-level window. The required preemptible kernel (CONFIG_PREEMPT/PREEMPT_DYNAMIC/PREEMPT_RT) and a perf-emitting eBPF agent are the default in Android, container, and cloud deployments.\nPR:L - Any unprivileged local process \u2014 including code confined inside a container or pod \u2014 triggers the cgroup BPF program merely by calling connect(), sendmsg(), or setsockopt(); no capability, CAP_BPF, or namespace privilege is required on the triggering side.\nUI:N - No victim action is needed; the attacker\u0027s own syscalls drive both racing invocations, and the presence of an attached eBPF monitoring program is ambient system configuration rather than user interaction.\nS:U - The corruption and its consequences are confined to the kernel\u0027s own security authority with no crossing of a hypervisor, IOMMU, or sandbox boundary. This is standard in-kernel memory corruption / privilege escalation.\nC:H - A hijacked perf_sample_data leaves sd-\u003eraw pointing at a dead kernel stack frame, so __output_copy() streams frag-\u003esize bytes from an unvalidated frag-\u003edata pointer into the perf ring buffer that userspace mmaps \u2014 an arbitrary kernel memory read primitive into attacker-readable memory.\nI:H - perf_output_sample() performs an indirect call through frag-\u003ecopy read from the stale stack frame (__output_custom), which the mainline reports observed as executing an NX-protected page and fetching instructions from address 0x1. Since the stale frame belongs to an attacker-controlled task, this is a groomable control-flow hijack primitive.\nA:H - The bug was reported from production as a hard kernel crash \u2014 NULL pointer dereference / supervisor instruction fetch oops in perf_output_sample \u2014 and can be triggered repeatedly by any local user, producing a reliable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T09:17:50.116Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3048cb0dc0cc9dc74ed93690dffef00733bcad5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/c81bdf8f9f2b002d217c3d5357cdea9f2b82ff90"
        },
        {
          "url": "https://git.kernel.org/stable/c/36dd8ca330b76585640ed32255a3c99f901e1502"
        },
        {
          "url": "https://git.kernel.org/stable/c/063c9ce8e74e07bf94f99cd13146f42867875e8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d62cc390c2e99ae267ffe4b8d7e2e08b6c758c32"
        }
      ],
      "title": "bpf: Disable preemption in bpf_event_output",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54173",
    "datePublished": "2025-12-30T12:08:46.842Z",
    "dateReserved": "2025-12-30T12:06:44.496Z",
    "dateUpdated": "2026-08-05T09:17:50.116Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.