CVE-2023-52920

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2023-52920", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T06:07:11.017Z", "datePublished": "2024-11-05T10:09:30.280Z", "dateUpdated": "2026-10-15T21:41:24.696Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:12:00.331Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: support non-r10 register spill/fill to/from stack in precision tracking\n\nUse instruction (jump) history to record instructions that performed\nregister spill/fill to/from stack, regardless if this was done through\nread-only r10 register, or any other register after copying r10 into it\n*and* potentially adjusting offset.\n\nTo make this work reliably, we push extra per-instruction flags into\ninstruction history, encoding stack slot index (spi) and stack frame\nnumber in extra 10 bit flags we take away from prev_idx in instruction\nhistory. We don't touch idx field for maximum performance, as it's\nchecked most frequently during backtracking.\n\nThis change removes basically the last remaining practical limitation of\nprecision backtracking logic in BPF verifier. It fixes known\ndeficiencies, but also opens up new opportunities to reduce number of\nverified states, explored in the subsequent patches.\n\nThere are only three differences in selftests' BPF object files\naccording to veristat, all in the positive direction (less states).\n\nFile Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF)\n-------------------------------------- ------------- --------- --------- ------------- ---------- ---------- -------------\ntest_cls_redirect_dynptr.bpf.linked3.o cls_redirect 2987 2864 -123 (-4.12%) 240 231 -9 (-3.75%)\nxdp_synproxy_kern.bpf.linked3.o syncookie_tc 82848 82661 -187 (-0.23%) 5107 5073 -34 (-0.67%)\nxdp_synproxy_kern.bpf.linked3.o syncookie_xdp 85116 84964 -152 (-0.18%) 5162 5130 -32 (-0.62%)\n\nNote, I avoided renaming jmp_history to more generic insn_hist to\nminimize number of lines changed and potential merge conflicts between\nbpf and bpf-next trees.\n\nNotice also cur_hist_entry pointer reset to NULL at the beginning of\ninstruction verification loop. This pointer avoids the problem of\nrelying on last jump history entry's insn_idx to determine whether we\nalready have entry for current instruction or not. It can happen that we\nadded jump history entry because current instruction is_jmp_point(), but\nalso we need to add instruction flags for stack access. In this case, we\ndon't want to entries, so we need to reuse last added entry, if it is\npresent.\n\nRelying on insn_idx comparison has the same ambiguity problem as the one\nthat was fixed recently in [0], so we avoid that.\n\n [0] https://patchwork.kernel.org/project/netdevbpf/patch/20231110002638.4168352-3-andrii@kernel.org/"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only by loading an attacker-crafted BPF program through the local bpf() syscall into the verifier; there is no network or adjacent-protocol path into precision backtracking.\nAC:L - The attacker fully controls the program that triggers non-r10 stack spill/fill and incorrect state pruning; with CAP_PERFMON (common alongside CAP_BPF), bpf_bypass_spec_v1() disables Spectre sanitization so exploitation does not depend on external conditions.\nPR:L - Exploitation requires CAP_BPF (and typically CAP_PERFMON), which are delegatable non-root capabilities routinely granted to containers and observability/networking agents rather than full init-namespace root, matching prior kernel CNA BPF scoring.\nUI:N - The attacker loads and attaches the malicious BPF program themselves; no separate victim action such as mounting a filesystem or opening a file is required.\nS:U - Successful exploitation yields host-kernel memory corruption and local privilege escalation within the same OS security authority, not a VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - Incorrect precision tracking lets the verifier accept a path that adds an attacker-controlled offset to a map pointer, enabling out-of-bounds reads of kernel memory (Tao Lyu demonstrated arbitrary read).\nI:H - The same map-pointer OOB write primitive supports arbitrary kernel writes and control-flow hijacking; the reporter successfully escalated to root privilege.\nA:H - The resulting out-of-bounds map access corrupts kernel memory and can oops/panic the kernel, and related non-r10/subprog backtracking paths also hit verifier WARN_ONCE backtracking bugs."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/bpf_verifier.h", "kernel/bpf/verifier.c", "tools/testing/selftests/bpf/progs/verifier_subprog_precision.c", "tools/testing/selftests/bpf/verifier/precise.c"], "versions": [{"version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e", "lessThan": "ecc2aeeaa08a355d84d3ca9c3d2512399a194f29", "status": "affected", "versionType": "git"}, {"version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e", "lessThan": "199f0452873741fa4b8d4d88958e929030b2f92b", "status": "affected", "versionType": "git"}, {"version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e", "lessThan": "e4da60feca4d35e1a9b03dc0affa3354f9ff45e4", "status": "affected", "versionType": "git"}, {"version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e", "lessThan": "41f6f64e6999a837048b1bd13a2f8742964eca6b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/bpf_verifier.h", "kernel/bpf/verifier.c", "tools/testing/selftests/bpf/progs/verifier_subprog_precision.c", "tools/testing/selftests/bpf/verifier/precise.c"], "versions": [{"version": "5.3", "status": "affected"}, {"version": "0", "lessThan": "5.3", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.64", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.70", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.6.64"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.6.70"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.3", "versionEndExcluding": "6.8"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ecc2aeeaa08a355d84d3ca9c3d2512399a194f29"}, {"url": "https://git.kernel.org/stable/c/199f0452873741fa4b8d4d88958e929030b2f92b"}, {"url": "https://git.kernel.org/stable/c/e4da60feca4d35e1a9b03dc0affa3354f9ff45e4"}, {"url": "https://git.kernel.org/stable/c/41f6f64e6999a837048b1bd13a2f8742964eca6b"}], "title": "bpf: support non-r10 register spill/fill to/from stack in precision tracking", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52920", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:32:50.854431Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:41:24.696Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-52920", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:32:50.854431Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:32:51.746Z"}}], "cna": {"title": "bpf: support non-r10 register spill/fill to/from stack in precision tracking", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only by loading an attacker-crafted BPF program through the local bpf() syscall into the verifier; there is no network or adjacent-protocol path into precision backtracking.\nAC:L - The attacker fully controls the program that triggers non-r10 stack spill/fill and incorrect state pruning; with CAP_PERFMON (common alongside CAP_BPF), bpf_bypass_spec_v1() disables Spectre sanitization so exploitation does not depend on external conditions.\nPR:L - Exploitation requires CAP_BPF (and typically CAP_PERFMON), which are delegatable non-root capabilities routinely granted to containers and observability/networking agents rather than full init-namespace root, matching prior kernel CNA BPF scoring.\nUI:N - The attacker loads and attaches the malicious BPF program themselves; no separate victim action such as mounting a filesystem or opening a file is required.\nS:U - Successful exploitation yields host-kernel memory corruption and local privilege escalation within the same OS security authority, not a VM escape, IOMMU bypass, or other cross-boundary effect.\nC:H - Incorrect precision tracking lets the verifier accept a path that adds an attacker-controlled offset to a map pointer, enabling out-of-bounds reads of kernel memory (Tao Lyu demonstrated arbitrary read).\nI:H - The same map-pointer OOB write primitive supports arbitrary kernel writes and control-flow hijacking; the reporter successfully escalated to root privilege.\nA:H - The resulting out-of-bounds map access corrupts kernel memory and can oops/panic the kernel, and related non-r10/subprog backtracking paths also hit verifier WARN_ONCE backtracking bugs."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e", "lessThan": "ecc2aeeaa08a355d84d3ca9c3d2512399a194f29", "versionType": "git"}, {"status": "affected", "version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e", "lessThan": "199f0452873741fa4b8d4d88958e929030b2f92b", "versionType": "git"}, {"status": "affected", "version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e", "lessThan": "e4da60feca4d35e1a9b03dc0affa3354f9ff45e4", "versionType": "git"}, {"status": "affected", "version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e", "lessThan": "41f6f64e6999a837048b1bd13a2f8742964eca6b", "versionType": "git"}], "programFiles": ["include/linux/bpf_verifier.h", "kernel/bpf/verifier.c", "tools/testing/selftests/bpf/progs/verifier_subprog_precision.c", "tools/testing/selftests/bpf/verifier/precise.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"status": "unaffected", "version": "0", "lessThan": "5.3", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.64", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.6.70", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.6.140", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/linux/bpf_verifier.h", "kernel/bpf/verifier.c", "tools/testing/selftests/bpf/progs/verifier_subprog_precision.c", "tools/testing/selftests/bpf/verifier/precise.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ecc2aeeaa08a355d84d3ca9c3d2512399a194f29"}, {"url": "https://git.kernel.org/stable/c/199f0452873741fa4b8d4d88958e929030b2f92b"}, {"url": "https://git.kernel.org/stable/c/e4da60feca4d35e1a9b03dc0affa3354f9ff45e4"}, {"url": "https://git.kernel.org/stable/c/41f6f64e6999a837048b1bd13a2f8742964eca6b"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: support non-r10 register spill/fill to/from stack in precision tracking\n\nUse instruction (jump) history to record instructions that performed\nregister spill/fill to/from stack, regardless if this was done through\nread-only r10 register, or any other register after copying r10 into it\n*and* potentially adjusting offset.\n\nTo make this work reliably, we push extra per-instruction flags into\ninstruction history, encoding stack slot index (spi) and stack frame\nnumber in extra 10 bit flags we take away from prev_idx in instruction\nhistory. We don't touch idx field for maximum performance, as it's\nchecked most frequently during backtracking.\n\nThis change removes basically the last remaining practical limitation of\nprecision backtracking logic in BPF verifier. It fixes known\ndeficiencies, but also opens up new opportunities to reduce number of\nverified states, explored in the subsequent patches.\n\nThere are only three differences in selftests' BPF object files\naccording to veristat, all in the positive direction (less states).\n\nFile Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF)\n-------------------------------------- ------------- --------- --------- ------------- ---------- ---------- -------------\ntest_cls_redirect_dynptr.bpf.linked3.o cls_redirect 2987 2864 -123 (-4.12%) 240 231 -9 (-3.75%)\nxdp_synproxy_kern.bpf.linked3.o syncookie_tc 82848 82661 -187 (-0.23%) 5107 5073 -34 (-0.67%)\nxdp_synproxy_kern.bpf.linked3.o syncookie_xdp 85116 84964 -152 (-0.18%) 5162 5130 -32 (-0.62%)\n\nNote, I avoided renaming jmp_history to more generic insn_hist to\nminimize number of lines changed and potential merge conflicts between\nbpf and bpf-next trees.\n\nNotice also cur_hist_entry pointer reset to NULL at the beginning of\ninstruction verification loop. This pointer avoids the problem of\nrelying on last jump history entry's insn_idx to determine whether we\nalready have entry for current instruction or not. It can happen that we\nadded jump history entry because current instruction is_jmp_point(), but\nalso we need to add instruction flags for stack access. In this case, we\ndon't want to entries, so we need to reuse last added entry, if it is\npresent.\n\nRelying on insn_idx comparison has the same ambiguity problem as the one\nthat was fixed recently in [0], so we avoid that.\n\n [0] https://patchwork.kernel.org/project/netdevbpf/patch/20231110002638.4168352-3-andrii@kernel.org/"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.64", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.70", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.140", "versionStartIncluding": "5.3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.8", "versionStartIncluding": "5.3"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:12:00.331Z"}}}, "cveMetadata": {"cveId": "CVE-2023-52920", "state": "PUBLISHED", "dateUpdated": "2026-10-15T21:41:24.696Z", "dateReserved": "2024-08-21T06:07:11.017Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-11-05T10:09:30.280Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/linux/bpf_verifier.h", "kernel/bpf/verifier.c", "tools/testing/selftests/bpf/progs/verifier_subprog_precision.c", "tools/testing/selftests/bpf/verifier/precise.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ecc2aeeaa08a355d84d3ca9c3d2512399a194f29", "status": "affected", "version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e", "versionType": "git"}, {"lessThan": "199f0452873741fa4b8d4d88958e929030b2f92b", "status": "affected", "version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e", "versionType": "git"}, {"lessThan": "e4da60feca4d35e1a9b03dc0affa3354f9ff45e4", "status": "affected", "version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e", "versionType": "git"}, {"lessThan": "41f6f64e6999a837048b1bd13a2f8742964eca6b", "status": "affected", "version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/linux/bpf_verifier.h", "kernel/bpf/verifier.c", "tools/testing/selftests/bpf/progs/verifier_subprog_precision.c", "tools/testing/selftests/bpf/verifier/precise.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.3"}, {"lessThan": "5.3", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.64", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.70", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.140", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0B66B9B-B773-474F-A817-85A8F2B3CF0E", "versionEndExcluding": "6.8", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: support non-r10 register spill/fill to/from stack in precision tracking\n\nUse instruction (jump) history to record instructions that performed\nregister spill/fill to/from stack, regardless if this was done through\nread-only r10 register, or any other register after copying r10 into it\n*and* potentially adjusting offset.\n\nTo make this work reliably, we push extra per-instruction flags into\ninstruction history, encoding stack slot index (spi) and stack frame\nnumber in extra 10 bit flags we take away from prev_idx in instruction\nhistory. We don't touch idx field for maximum performance, as it's\nchecked most frequently during backtracking.\n\nThis change removes basically the last remaining practical limitation of\nprecision backtracking logic in BPF verifier. It fixes known\ndeficiencies, but also opens up new opportunities to reduce number of\nverified states, explored in the subsequent patches.\n\nThere are only three differences in selftests' BPF object files\naccording to veristat, all in the positive direction (less states).\n\nFile Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF)\n-------------------------------------- ------------- --------- --------- ------------- ---------- ---------- -------------\ntest_cls_redirect_dynptr.bpf.linked3.o cls_redirect 2987 2864 -123 (-4.12%) 240 231 -9 (-3.75%)\nxdp_synproxy_kern.bpf.linked3.o syncookie_tc 82848 82661 -187 (-0.23%) 5107 5073 -34 (-0.67%)\nxdp_synproxy_kern.bpf.linked3.o syncookie_xdp 85116 84964 -152 (-0.18%) 5162 5130 -32 (-0.62%)\n\nNote, I avoided renaming jmp_history to more generic insn_hist to\nminimize number of lines changed and potential merge conflicts between\nbpf and bpf-next trees.\n\nNotice also cur_hist_entry pointer reset to NULL at the beginning of\ninstruction verification loop. This pointer avoids the problem of\nrelying on last jump history entry's insn_idx to determine whether we\nalready have entry for current instruction or not. It can happen that we\nadded jump history entry because current instruction is_jmp_point(), but\nalso we need to add instruction flags for stack access. In this case, we\ndon't want to entries, so we need to reuse last added entry, if it is\npresent.\n\nRelying on insn_idx comparison has the same ambiguity problem as the one\nthat was fixed recently in [0], so we avoid that.\n\n [0] https://patchwork.kernel.org/project/netdevbpf/patch/20231110002638.4168352-3-andrii@kernel.org/"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: soporte para derrame/relleno de registros que no sean r10 hacia/desde la pila en seguimiento de precisi\u00f3n. Use el historial de instrucciones (saltos) para registrar instrucciones que realizaron derrame/relleno de registros hacia/desde la pila, independientemente de si esto se hizo a trav\u00e9s de un registro r10 de solo lectura, o cualquier otro registro despu\u00e9s de copiar r10 en \u00e9l *y* potencialmente ajustar el desplazamiento. Para que esto funcione de manera confiable, insertamos indicadores adicionales por instrucci\u00f3n en el historial de instrucciones, codificando el \u00edndice de ranura de pila (spi) y el n\u00famero de marco de pila en indicadores adicionales de 10 bits que quitamos de prev_idx en el historial de instrucciones. No tocamos el campo idx para obtener el m\u00e1ximo rendimiento, ya que se verifica con mayor frecuencia durante el seguimiento hacia atr\u00e1s. Este cambio elimina b\u00e1sicamente la \u00faltima limitaci\u00f3n pr\u00e1ctica restante de la l\u00f3gica de seguimiento hacia atr\u00e1s de precisi\u00f3n en el verificador BPF. Corrige deficiencias conocidas, pero tambi\u00e9n abre nuevas oportunidades para reducir la cantidad de estados verificados, exploradas en los parches posteriores. Solo hay tres diferencias en los archivos de objetos BPF de las autopruebas seg\u00fan veristat, todas en la direcci\u00f3n positiva (menos estados). Archivo Programa Insns (A) Insns (B) Insns (DIFF) Estados (A) Estados (B) Estados (DIFF) -------------------------------------- ------------- --------- --------- ------------- ---------- ---------- ------------- test_cls_redirect_dynptr.bpf.linked3.o cls_redirect 2987 2864 -123 (-4,12%) 240 231 -9 (-3,75%) xdp_synproxy_kern.bpf.linked3.o syncookie_tc 82848 82661 -187 (-0,23%) 5107 5073 -34 (-0,67%) xdp_synproxy_kern.bpf.linked3.o syncookie_xdp 85116 84964 -152 (-0,18%) 5162 5130 -32 (-0,62%) Nota: evit\u00e9 cambiar el nombre de jmp_history al m\u00e1s gen\u00e9rico insn_hist para minimizar la cantidad de l\u00edneas cambiadas y los posibles conflictos de fusi\u00f3n entre los \u00e1rboles bpf y bpf-next. Observe tambi\u00e9n que el puntero cur_hist_entry se restablece a NULL al comienzo del bucle de verificaci\u00f3n de instrucciones. Este puntero evita el problema de confiar en el insn_idx de la \u00faltima entrada del historial de saltos para determinar si ya tenemos una entrada para la instrucci\u00f3n actual o no. Puede suceder que agreguemos una entrada del historial de saltos porque la instrucci\u00f3n actual es_jmp_point(), pero tambi\u00e9n necesitamos agregar indicadores de instrucci\u00f3n para el acceso a la pila. En este caso, no queremos entradas, por lo que necesitamos reutilizar la \u00faltima entrada agregada, si est\u00e1 presente. Confiar en la comparaci\u00f3n insn_idx tiene el mismo problema de ambig\u00fcedad que el que se solucion\u00f3 recientemente en [0], por lo que lo evitamos. [0] https://patchwork.kernel.org/project/netdevbpf/patch/20231110002638.4168352-3-andrii@kernel.org/"}], "id": "CVE-2023-52920", "lastModified": "2026-10-15T22:17:34.987", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-52920", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:32:50.854431Z", "version": "2.0.3"}}]}, "published": "2024-11-05T10:15:24.580", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/199f0452873741fa4b8d4d88958e929030b2f92b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Mailing List", "Patch"], "url": "https://git.kernel.org/stable/c/41f6f64e6999a837048b1bd13a2f8742964eca6b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e4da60feca4d35e1a9b03dc0affa3354f9ff45e4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ecc2aeeaa08a355d84d3ca9c3d2512399a194f29"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bpf: support non-r10 register spill/fill to/from stack in precision tracking", "id": "2323841", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2323841"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nbpf: support non-r10 register spill/fill to/from stack in precision tracking\nUse instruction (jump) history to record instructions that performed\nregister spill/fill to/from stack, regardless if this was done through\nread-only r10 register, or any other register after copying r10 into it\n*and* potentially adjusting offset.\nTo make this work reliably, we push extra per-instruction flags into\ninstruction history, encoding stack slot index (spi) and stack frame\nnumber in extra 10 bit flags we take away from prev_idx in instruction\nhistory. We don't touch idx field for maximum performance, as it's\nchecked most frequently during backtracking.\nThis change removes basically the last remaining practical limitation of\nprecision backtracking logic in BPF verifier. It fixes known\ndeficiencies, but also opens up new opportunities to reduce number of\nverified states, explored in the subsequent patches.\nThere are only three differences in selftests' BPF object files\naccording to veristat, all in the positive direction (less states).\nFile Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF)\n-------------------------------------- ------------- --------- --------- ------------- ---------- ---------- -------------\ntest_cls_redirect_dynptr.bpf.linked3.o cls_redirect 2987 2864 -123 (-4.12%) 240 231 -9 (-3.75%)\nxdp_synproxy_kern.bpf.linked3.o syncookie_tc 82848 82661 -187 (-0.23%) 5107 5073 -34 (-0.67%)\nxdp_synproxy_kern.bpf.linked3.o syncookie_xdp 85116 84964 -152 (-0.18%) 5162 5130 -32 (-0.62%)\nNote, I avoided renaming jmp_history to more generic insn_hist to\nminimize number of lines changed and potential merge conflicts between\nbpf and bpf-next trees.\nNotice also cur_hist_entry pointer reset to NULL at the beginning of\ninstruction verification loop. This pointer avoids the problem of\nrelying on last jump history entry's insn_idx to determine whether we\nalready have entry for current instruction or not. It can happen that we\nadded jump history entry because current instruction is_jmp_point(), but\nalso we need to add instruction flags for stack access. In this case, we\ndon't want to entries, so we need to reuse last added entry, if it is\npresent.\nRelying on insn_idx comparison has the same ambiguity problem as the one\nthat was fixed recently in [0], so we avoid that.\n[0] https://patchwork.kernel.org/project/netdevbpf/patch/20231110002638.4168352-3-andrii@kernel.org/"], "name": "CVE-2023-52920", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-11-05T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-52920\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-52920\nhttps://lore.kernel.org/linux-cve-announce/2024110518-CVE-2023-52920-17f6@gregkh/T"], "threat_severity": "Moderate"}

{}