CVE-2023-52676

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-52676", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-07T14:49:46.886Z", "datePublished": "2024-05-17T14:24:41.387Z", "dateUpdated": "2026-09-14T11:57:40.801Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-14T11:57:40.801Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard stack limits against 32bit overflow\n\nThis patch promotes the arithmetic around checking stack bounds to be\ndone in the 64-bit domain, instead of the current 32bit. The arithmetic\nimplies adding together a 64-bit register with a int offset. The\nregister was checked to be below 1<<29 when it was variable, but not\nwhen it was fixed. The offset either comes from an instruction (in which\ncase it is 16 bit), from another register (in which case the caller\nchecked it to be below 1<<29 [1]), or from the size of an argument to a\nkfunc (in which case it can be a u32 [2]). Between the register being\ninconsistently checked to be below 1<<29, and the offset being up to an\nu32, it appears that we were open to overflowing the `int`s which were\ncurrently used for arithmetic.\n\n[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498\n[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in the BPF verifier's stack bounds checking during bpf(BPF_PROG_LOAD); it is reached only via a local syscall, not via network packet processing.\nAC:L - An attacker fully controls the submitted BPF bytecode and offsets/sizes that feed the overflowing int arithmetic, so the bad bounds calculation can be triggered reliably with no conditions outside attacker control.\nPR:L - The vulnerable const stack-bounds path runs for ordinary stack accesses during program load, including for unprivileged SOCKET_FILTER/CGROUP_SKB when unprivileged BPF is enabled; CAP_BPF is not required for all reachability paths.\nUI:N - Exploitation requires only calling bpf() with a crafted program; no victim interaction is needed.\nS:U - Impact stays within the host kernel authority (verifier memory corruption and/or local privilege escalation); this is not a VM/IOMMU/guest-to-host boundary crossing.\nC:H - Integer overflow can bypass stack bounds checks and lead to out-of-bounds accesses of verifier stack-slot state and/or runtime BPF stack, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same overflow enables out-of-bounds writes in verifier tracking and/or a verifier bypass allowing corrupted BPF stack accesses at runtime, which is exploitable for control-flow hijacking and privilege escalation.\nA:H - Failed bounds math has caused out-of-bounds accesses and kernel oopses in check_stack_range_initialized() during verification, so availability impact is a full kernel crash."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "f3c4b01689d392373301e6e60d1b02c5b4020afc", "lessThan": "ad1754f86a87fe74912fb542b23ff24ada4e3307", "status": "affected", "versionType": "git"}, {"version": "01f810ace9ed37255f27608a0864abebccf0aab3", "lessThan": "4ba97610399e83d29d1086a0827d33172539b49b", "status": "affected", "versionType": "git"}, {"version": "01f810ace9ed37255f27608a0864abebccf0aab3", "lessThan": "e160b2ed94a20fa940369ebd914277f88005e70d", "status": "affected", "versionType": "git"}, {"version": "01f810ace9ed37255f27608a0864abebccf0aab3", "lessThan": "ad140fc856f0b1d5e2215bcb6d0cc247a86805a2", "status": "affected", "versionType": "git"}, {"version": "01f810ace9ed37255f27608a0864abebccf0aab3", "lessThan": "e5ad9ecb84405637df82732ee02ad741a5f782a6", "status": "affected", "versionType": "git"}, {"version": "01f810ace9ed37255f27608a0864abebccf0aab3", "lessThan": "1d38a9ee81570c4bd61f557832dead4d6f816760", "status": "affected", "versionType": "git"}, {"version": "d1b725ea5d104caea250427899f4e2e3ab15b4fc", "status": "affected", "versionType": "git"}, {"version": "5.10.33", "lessThan": "5.10.270", "status": "affected", "versionType": "semver"}, {"version": "5.11.17", "lessThan": "5.12", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/verifier.c"], "versions": [{"version": "5.12", "status": "affected"}, {"version": "0", "lessThan": "5.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.270", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.14", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.2", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.33", "versionEndExcluding": "5.10.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.6.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.12", "versionEndExcluding": "6.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ad1754f86a87fe74912fb542b23ff24ada4e3307"}, {"url": "https://git.kernel.org/stable/c/4ba97610399e83d29d1086a0827d33172539b49b"}, {"url": "https://git.kernel.org/stable/c/e160b2ed94a20fa940369ebd914277f88005e70d"}, {"url": "https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2"}, {"url": "https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6"}, {"url": "https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760"}], "title": "bpf: Guard stack limits against 32bit overflow", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-06-12T15:14:32.563852Z", "id": "CVE-2023-52676", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-12T15:14:46.799Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:11:34.390Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:11:34.390Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52676", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-06-12T15:14:32.563852Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-12T15:14:42.452Z"}}], "cna": {"title": "bpf: Guard stack limits against 32bit overflow", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in the BPF verifier's stack bounds checking during bpf(BPF_PROG_LOAD); it is reached only via a local syscall, not via network packet processing.\nAC:L - An attacker fully controls the submitted BPF bytecode and offsets/sizes that feed the overflowing int arithmetic, so the bad bounds calculation can be triggered reliably with no conditions outside attacker control.\nPR:L - The vulnerable const stack-bounds path runs for ordinary stack accesses during program load, including for unprivileged SOCKET_FILTER/CGROUP_SKB when unprivileged BPF is enabled; CAP_BPF is not required for all reachability paths.\nUI:N - Exploitation requires only calling bpf() with a crafted program; no victim interaction is needed.\nS:U - Impact stays within the host kernel authority (verifier memory corruption and/or local privilege escalation); this is not a VM/IOMMU/guest-to-host boundary crossing.\nC:H - Integer overflow can bypass stack bounds checks and lead to out-of-bounds accesses of verifier stack-slot state and/or runtime BPF stack, which can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same overflow enables out-of-bounds writes in verifier tracking and/or a verifier bypass allowing corrupted BPF stack accesses at runtime, which is exploitable for control-flow hijacking and privilege escalation.\nA:H - Failed bounds math has caused out-of-bounds accesses and kernel oopses in check_stack_range_initialized() during verification, so availability impact is a full kernel crash."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "f3c4b01689d392373301e6e60d1b02c5b4020afc", "lessThan": "ad1754f86a87fe74912fb542b23ff24ada4e3307", "versionType": "git"}, {"status": "affected", "version": "01f810ace9ed37255f27608a0864abebccf0aab3", "lessThan": "4ba97610399e83d29d1086a0827d33172539b49b", "versionType": "git"}, {"status": "affected", "version": "01f810ace9ed37255f27608a0864abebccf0aab3", "lessThan": "e160b2ed94a20fa940369ebd914277f88005e70d", "versionType": "git"}, {"status": "affected", "version": "01f810ace9ed37255f27608a0864abebccf0aab3", "lessThan": "ad140fc856f0b1d5e2215bcb6d0cc247a86805a2", "versionType": "git"}, {"status": "affected", "version": "01f810ace9ed37255f27608a0864abebccf0aab3", "lessThan": "e5ad9ecb84405637df82732ee02ad741a5f782a6", "versionType": "git"}, {"status": "affected", "version": "01f810ace9ed37255f27608a0864abebccf0aab3", "lessThan": "1d38a9ee81570c4bd61f557832dead4d6f816760", "versionType": "git"}, {"status": "affected", "version": "d1b725ea5d104caea250427899f4e2e3ab15b4fc", "versionType": "git"}, {"status": "affected", "version": "5.10.33", "lessThan": "5.10.270", "versionType": "semver"}, {"status": "affected", "version": "5.11.17", "lessThan": "5.12", "versionType": "semver"}], "programFiles": ["kernel/bpf/verifier.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"status": "unaffected", "version": "0", "lessThan": "5.12", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.270", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.221", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.188", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.14", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.2", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/bpf/verifier.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ad1754f86a87fe74912fb542b23ff24ada4e3307"}, {"url": "https://git.kernel.org/stable/c/4ba97610399e83d29d1086a0827d33172539b49b"}, {"url": "https://git.kernel.org/stable/c/e160b2ed94a20fa940369ebd914277f88005e70d"}, {"url": "https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2"}, {"url": "https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6"}, {"url": "https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard stack limits against 32bit overflow\n\nThis patch promotes the arithmetic around checking stack bounds to be\ndone in the 64-bit domain, instead of the current 32bit. The arithmetic\nimplies adding together a 64-bit register with a int offset. The\nregister was checked to be below 1<<29 when it was variable, but not\nwhen it was fixed. The offset either comes from an instruction (in which\ncase it is 16 bit), from another register (in which case the caller\nchecked it to be below 1<<29 [1]), or from the size of an argument to a\nkfunc (in which case it can be a u32 [2]). Between the register being\ninconsistently checked to be below 1<<29, and the offset being up to an\nu32, it appears that we were open to overflowing the `int`s which were\ncurrently used for arithmetic.\n\n[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498\n[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.270", "versionStartIncluding": "5.10.33"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.221", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.188", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.14", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.7.2", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "5.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.11.17"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-14T11:57:40.801Z"}}}, "cveMetadata": {"cveId": "CVE-2023-52676", "state": "PUBLISHED", "dateUpdated": "2026-09-14T11:57:40.801Z", "dateReserved": "2024-03-07T14:49:46.886Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-17T14:24:41.387Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ad1754f86a87fe74912fb542b23ff24ada4e3307", "status": "affected", "version": "f3c4b01689d392373301e6e60d1b02c5b4020afc", "versionType": "git"}, {"lessThan": "4ba97610399e83d29d1086a0827d33172539b49b", "status": "affected", "version": "01f810ace9ed37255f27608a0864abebccf0aab3", "versionType": "git"}, {"lessThan": "e160b2ed94a20fa940369ebd914277f88005e70d", "status": "affected", "version": "01f810ace9ed37255f27608a0864abebccf0aab3", "versionType": "git"}, {"lessThan": "ad140fc856f0b1d5e2215bcb6d0cc247a86805a2", "status": "affected", "version": "01f810ace9ed37255f27608a0864abebccf0aab3", "versionType": "git"}, {"lessThan": "e5ad9ecb84405637df82732ee02ad741a5f782a6", "status": "affected", "version": "01f810ace9ed37255f27608a0864abebccf0aab3", "versionType": "git"}, {"lessThan": "1d38a9ee81570c4bd61f557832dead4d6f816760", "status": "affected", "version": "01f810ace9ed37255f27608a0864abebccf0aab3", "versionType": "git"}, {"status": "affected", "version": "d1b725ea5d104caea250427899f4e2e3ab15b4fc", "versionType": "git"}, {"lessThan": "5.10.270", "status": "affected", "version": "5.10.33", "versionType": "semver"}, {"lessThan": "5.12", "status": "affected", "version": "5.11.17", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/bpf/verifier.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.12"}, {"lessThan": "5.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.270", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.14", "versionType": "semver"}, {"lessThanOrEqual": "6.7.*", "status": "unaffected", "version": "6.7.2", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "2EEAEE35-CD34-43B5-8F63-EA8A43513930", "versionEndExcluding": "5.11", "versionStartIncluding": "5.10.33", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F024C7CE-4C5E-46AF-AEA5-D041B2AA3B2B", "versionEndExcluding": "6.6.14", "versionStartIncluding": "5.11.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7229C448-E0C9-488B-8939-36BA5254065E", "versionEndExcluding": "6.7.2", "versionStartIncluding": "6.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard stack limits against 32bit overflow\n\nThis patch promotes the arithmetic around checking stack bounds to be\ndone in the 64-bit domain, instead of the current 32bit. The arithmetic\nimplies adding together a 64-bit register with a int offset. The\nregister was checked to be below 1<<29 when it was variable, but not\nwhen it was fixed. The offset either comes from an instruction (in which\ncase it is 16 bit), from another register (in which case the caller\nchecked it to be below 1<<29 [1]), or from the size of an argument to a\nkfunc (in which case it can be a u32 [2]). Between the register being\ninconsistently checked to be below 1<<29, and the offset being up to an\nu32, it appears that we were open to overflowing the `int`s which were\ncurrently used for arithmetic.\n\n[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498\n[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Proteger los l\u00edmites de la pila contra el desbordamiento de 32 bits. Este parche promueve que la aritm\u00e9tica en torno a la verificaci\u00f3n de los l\u00edmites de la pila se realice en el dominio de 64 bits, en lugar del actual de 32 bits. La aritm\u00e9tica implica sumar un registro de 64 bits con un desplazamiento int. Se comprob\u00f3 que el registro estaba por debajo de 1&lt;&lt;29 cuando era variable, pero no cuando estaba arreglado. El desplazamiento proviene de una instrucci\u00f3n (en cuyo caso es de 16 bits), de otro registro (en cuyo caso la persona que llama comprob\u00f3 que estaba por debajo de 1&lt;&lt;29 [1]) o del tama\u00f1o de un argumento para kfunc. (en cuyo caso puede ser un u32 [2]). Entre que el registro se verificaba de manera inconsistente para que estuviera por debajo de 1&lt;&lt;29 y el desplazamiento era de hasta u32, parece que est\u00e1bamos abiertos a desbordar los \"int\" que se usaban actualmente para la aritm\u00e9tica. [1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498 [2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e 50f6cd80eb10235fe3e9/n\u00facleo /bpf/verifier.c#L11904"}], "id": "CVE-2023-52676", "lastModified": "2026-09-14T12:17:32.653", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-52676", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-06-12T15:14:32.563852Z", "version": "2.0.3"}}]}, "published": "2024-05-17T15:15:18.633", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4ba97610399e83d29d1086a0827d33172539b49b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ad1754f86a87fe74912fb542b23ff24ada4e3307"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e160b2ed94a20fa940369ebd914277f88005e70d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1d38a9ee81570c4bd61f557832dead4d6f816760"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ad140fc856f0b1d5e2215bcb6d0cc247a86805a2"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e5ad9ecb84405637df82732ee02ad741a5f782a6"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}], "bugzilla": {"description": "kernel: bpf: Guard stack limits against 32bit overflow", "id": "2281332", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281332"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: Guard stack limits against 32bit overflow\nThis patch promotes the arithmetic around checking stack bounds to be\ndone in the 64-bit domain, instead of the current 32bit. The arithmetic\nimplies adding together a 64-bit register with a int offset. The\nregister was checked to be below 1<<29 when it was variable, but not\nwhen it was fixed. The offset either comes from an instruction (in which\ncase it is 16 bit), from another register (in which case the caller\nchecked it to be below 1<<29 [1]), or from the size of an argument to a\nkfunc (in which case it can be a u32 [2]). Between the register being\ninconsistently checked to be below 1<<29, and the offset being up to an\nu32, it appears that we were open to overflowing the `int`s which were\ncurrently used for arithmetic.\n[1] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L7494-L7498\n[2] https://github.com/torvalds/linux/blob/815fb87b753055df2d9e50f6cd80eb10235fe3e9/kernel/bpf/verifier.c#L11904"], "name": "CVE-2023-52676", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-52676\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-52676\nhttps://lore.kernel.org/linux-cve-announce/2024051749-CVE-2023-52676-e224@gregkh/T"], "threat_severity": "Low"}

{}