6.7
MEDIUM
CVE-2023-52447
Linux Kernel BPF RCU Use-After-Free Vulnerability
Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program or sleepable program. However bpf_map_fd_put_ptr() decreases the ref-counter of the inner map directly through bpf_map_put(), if the ref-counter is the last one (which is true for most cases), the inner map will be freed by ops->map_free() in a kworker. But for now, most .map_free() callbacks don't use synchronize_rcu() or its variants to wait for the elapse of a RCU grace period, so after the invocation of ops->map_free completes, the bpf program which is accessing the inner map may incur use-after-free problem. Fix the free of inner map by invoking bpf_map_free_deferred() after both one RCU grace period and one tasks trace RCU grace period if the inner map has been removed from the outer map before. The deferment is accomplished by using call_rcu() or call_rcu_tasks_trace() when releasing the last ref-counter of bpf map. The newly-added rcu_head field in bpf_map shares the same storage space with work field to reduce the size of bpf_map.

INFO

Published Date :

Feb. 22, 2024, 5:15 p.m.

Last Modified :

Nov. 21, 2024, 8:39 a.m.

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Remotely Exploitable :

No

Impact Score :

5.9

Exploitability Score :

0.8
Affected Products

The following products are affected by CVE-2023-52447 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2023-52447 vulnerability anywhere in the article.

  • Cybersecurity News
Hikvision Patches Security Flaw in Network Cameras, Preventing Cleartext Credential Transmission

Hikvision, a leading provider of network cameras and surveillance systems, has released firmware updates to address a security vulnerability that could expose users’ Dynamic DNS credentials. The vulne ... Read more

Published Date: Nov 01, 2024 (1 month ago)
  • Cybersecurity News
Microsoft Boosts Email Security with General Availability of Inbound SMTP DANE with DNSSEC

Microsoft announced the general availability of Inbound SMTP DANE with DNSSEC for Exchange Online, marking a significant step forward in email security. This powerful feature combines two robust secur ... Read more

Published Date: Oct 30, 2024 (1 month ago)
  • Cybersecurity News
Atlassian Confluence Vulnerability CVE-2023-22527 Exploited for Cryptomining

Attach chain | Image: Trend MicroIn a recently disclosed report by Trend Micro, attackers were observed exploiting a vulnerability in Atlassian’s Confluence servers (CVE-2023-22527) to hijack victim r ... Read more

Published Date: Oct 30, 2024 (1 month ago)
  • Cybersecurity News
Cisco Investigates Potential Data Exposure, Confirms No Breach of Internal Systems

Cisco Systems is currently investigating an alleged unauthorized access to data housed on a public-facing DevHub environment. While initial reports suggested a potential breach of Cisco’s internal sys ... Read more

Published Date: Oct 21, 2024 (1 month, 2 weeks ago)

The following table lists the changes that have been made to the CVE-2023-52447 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference https://git.kernel.org/stable/c/37d98fb9c3144c0fddf7f6e99aece9927ac8dce6
    Added Reference https://git.kernel.org/stable/c/62fca83303d608ad4fec3f7428c8685680bb01b0
    Added Reference https://git.kernel.org/stable/c/876673364161da50eed6b472d746ef88242b2368
    Added Reference https://git.kernel.org/stable/c/90c445799fd1dc214d7c6279c144e33a35e29ef2
    Added Reference https://git.kernel.org/stable/c/bfd9b20c4862f41d4590fde11d70a5eeae53dcc5
    Added Reference https://git.kernel.org/stable/c/f91cd728b10c51f6d4a39957ccd56d1e802fc8ee
    Added Reference https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Nov. 04, 2024

    Action Type Old Value New Value
    Removed Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html
  • CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0

    Oct. 15, 2024

    Action Type Old Value New Value
    Added CWE CISA-ADP CWE-416
    Added CVSS V3.1 CISA-ADP AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • Reanalysis by [email protected]

    Oct. 07, 2024

    Action Type Old Value New Value
    Removed CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Added CVSS V3.1 NIST AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  • Modified Analysis by [email protected]

    Aug. 26, 2024

    Action Type Old Value New Value
    Changed Reference Type https://git.kernel.org/stable/c/37d98fb9c3144c0fddf7f6e99aece9927ac8dce6 No Types Assigned https://git.kernel.org/stable/c/37d98fb9c3144c0fddf7f6e99aece9927ac8dce6 Patch
    Changed Reference Type https://git.kernel.org/stable/c/90c445799fd1dc214d7c6279c144e33a35e29ef2 No Types Assigned https://git.kernel.org/stable/c/90c445799fd1dc214d7c6279c144e33a35e29ef2 Patch
    Changed Reference Type https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html No Types Assigned https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Mailing List, Third Party Advisory
    Changed CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.9.0 up to (excluding) 6.1.75 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2.0 up to (excluding) 6.6.14 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7.0 up to (excluding) 6.7.2 OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.9.0 up to (excluding) 5.10.214 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.153 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.75 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.14 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.7.2
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jun. 25, 2024

    Action Type Old Value New Value
    Added Reference kernel.org https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html [No types assigned]
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    May. 28, 2024

    Action Type Old Value New Value
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Mar. 27, 2024

    Action Type Old Value New Value
    Added Reference kernel.org https://git.kernel.org/stable/c/90c445799fd1dc214d7c6279c144e33a35e29ef2 [No types assigned]
    Added Reference kernel.org https://git.kernel.org/stable/c/37d98fb9c3144c0fddf7f6e99aece9927ac8dce6 [No types assigned]
  • Initial Analysis by [email protected]

    Mar. 14, 2024

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://git.kernel.org/stable/c/62fca83303d608ad4fec3f7428c8685680bb01b0 No Types Assigned https://git.kernel.org/stable/c/62fca83303d608ad4fec3f7428c8685680bb01b0 Patch
    Changed Reference Type https://git.kernel.org/stable/c/876673364161da50eed6b472d746ef88242b2368 No Types Assigned https://git.kernel.org/stable/c/876673364161da50eed6b472d746ef88242b2368 Patch
    Changed Reference Type https://git.kernel.org/stable/c/bfd9b20c4862f41d4590fde11d70a5eeae53dcc5 No Types Assigned https://git.kernel.org/stable/c/bfd9b20c4862f41d4590fde11d70a5eeae53dcc5 Patch
    Changed Reference Type https://git.kernel.org/stable/c/f91cd728b10c51f6d4a39957ccd56d1e802fc8ee No Types Assigned https://git.kernel.org/stable/c/f91cd728b10c51f6d4a39957ccd56d1e802fc8ee Patch
    Added CWE NIST CWE-416
    Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.9.0 up to (excluding) 6.1.75 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2.0 up to (excluding) 6.6.14 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7.0 up to (excluding) 6.7.2
  • CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Feb. 22, 2024

    Action Type Old Value New Value
    Added Description In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program or sleepable program. However bpf_map_fd_put_ptr() decreases the ref-counter of the inner map directly through bpf_map_put(), if the ref-counter is the last one (which is true for most cases), the inner map will be freed by ops->map_free() in a kworker. But for now, most .map_free() callbacks don't use synchronize_rcu() or its variants to wait for the elapse of a RCU grace period, so after the invocation of ops->map_free completes, the bpf program which is accessing the inner map may incur use-after-free problem. Fix the free of inner map by invoking bpf_map_free_deferred() after both one RCU grace period and one tasks trace RCU grace period if the inner map has been removed from the outer map before. The deferment is accomplished by using call_rcu() or call_rcu_tasks_trace() when releasing the last ref-counter of bpf map. The newly-added rcu_head field in bpf_map shares the same storage space with work field to reduce the size of bpf_map.
    Added Reference Linux https://git.kernel.org/stable/c/62fca83303d608ad4fec3f7428c8685680bb01b0 [No types assigned]
    Added Reference Linux https://git.kernel.org/stable/c/f91cd728b10c51f6d4a39957ccd56d1e802fc8ee [No types assigned]
    Added Reference Linux https://git.kernel.org/stable/c/bfd9b20c4862f41d4590fde11d70a5eeae53dcc5 [No types assigned]
    Added Reference Linux https://git.kernel.org/stable/c/876673364161da50eed6b472d746ef88242b2368 [No types assigned]
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2023-52447 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2023-52447 weaknesses.

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability