CVE-2023-52928

bpf: Skip invalid kfunc call in backtrack_insn

published March 27, 2025

CVSS
—
EPSS
0%
Percentile
15.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

bpf: Skip invalid kfunc call in backtrack_insn

The verifier skips invalid kfunc call in check_kfunc_call(), which

would be captured in fixup_kfunc_call() if such insn is not eliminated

by dead code elimination. However, this can lead to the following

warning in backtrack_insn(), also see [1]:

------------[ cut here ]------------

verifier backtracking bug

WARNING: CPU: 6 PID: 8646 at kernel/bpf/verifier.c:2756 backtrack_insn

kernel/bpf/verifier.c:2756

__mark_chain_precision kernel/bpf/verifier.c:3065

mark_chain_precision kernel/bpf/verifier.c:3165

adjust_reg_min_max_vals kernel/bpf/verifier.c:10715

check_alu_op kernel/bpf/verifier.c:10928

do_check kernel/bpf/verifier.c:13821 [inline]

do_check_common kernel/bpf/verifier.c:16289

[...]

So make backtracking conservative with this by returning ENOTSUPP.

[1] https://lore.kernel.org/bpf/CACkBjsaXNceR8ZjkLG=dT3P=4A8SBsg0Z5h5PWLryF5=ghKq=g@mail.gmail.com/

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00250 · 15.4th percentile
Published
2025-03-27T16:37Z
EPSS history
Timeline
  • 27 MAR 16:37Z
    bpf: Skip invalid kfunc call in backtrack_insn
    cvelistv5