bpf: support non-r10 register spill/fill to/from stack in precision tracking
In the Linux kernel, the following vulnerability has been resolved: bpf: support non-r10 register spill/fill to/from stack in precision tracking Use instruction (jump) history to record instructions that performed register spill/fill to/from stack, regardless if this was done through read-only r10 register, or any other register after copying r10 into it *and* potentially adjusting offset. To make this work reliably, we push extra per-instruction flags into instruction history, encoding stack slot index (spi) and stack frame number in extra 10 bit flags we take away from prev_idx in instruction history. We don't touch idx field for maximum performance, as it's checked most frequently during backtracking. This change removes basically the last remaining practical limitation of precision backtracking logic in BPF verifier. It fixes known deficiencies, but also opens up new opportunities to reduce number of verified states, explored in the subsequent patches. There are only three differences in selftests' BPF object files according to veristat, all in the positive direction (less states). File Program Insns (A) Insns (B) Insns (DIFF) States (A) States (B) States (DIFF) -------------------------------------- ------------- --------- --------- ------------- ---------- ---------- ------------- test_cls_redirect_dynptr.bpf.linked3.o cls_redirect 2987 2864 -123 (-4.12%) 240 231 -9 (-3.75%) xdp_synproxy_kern.bpf.linked3.o syncookie_tc 82848 82661 -187 (-0.23%) 5107 5073 -34 (-0.67%) xd
CVE-2023-52920
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2023-52920
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e",
"lessThan": "ecc2aeeaa08a355d84d3ca9c3d2512399a194f29",
"versionType": "git"
},
{
"status": "affected",
"version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e",
"lessThan": "199f0452873741fa4b8d4d88958e929030b2f92b",
"versionType": "git"
},
{
"status": "affected",
"version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e",
"lessThan": "e4da60feca4d35e1a9b03dc0affa3354f9ff45e4",
"versionType": "git"
},
{
"status": "affected",
"version": "b5dc0163d8fd78e64a7e21f309cf932fda34353e",
"lessThan": "41f6f64e6999a837048b1bd13a2f8742964eca6b",
"versionType": "git"
}
],
"programFiles": [
"include/linux/bpf_verifier.h",
"kernel/bpf/verifier.c",
"tools/testing/selftests/bpf/progs/verifier_subprog_precision.c",
"tools/testing/selftests/bpf/verifier/precise.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.64",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.6.70",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.6.140",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.8",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/linux/bpf_verifier.h",
"kernel/bpf/verifier.c",
"tools/testing/selftests/bpf/progs/verifier_subprog_precision.c",
"tools/testing/selftests/bpf/verifier/precise.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2023-52920
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #30241 · Revision 1
- Added to Heist Feed
- Publisher date