PT-2024-14783 · Linux+3 · Linux Kernel+3
Tao Lyu
·
Published
2023-12-05
·
Updated
2026-05-17
·
CVE-2023-52920
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The issue concerns a flaw in the Linux kernel's BPF verifier, specifically with precision tracking for non-r10 register spill/fill to/from stack. This change aims to record instructions that performed register spill/fill to/from stack, regardless of the register used, and potentially adjusting the offset. The fix removes a practical limitation of precision backtracking logic in the BPF verifier, addressing known deficiencies and opening up opportunities to reduce the number of verified states. According to selftests' BPF object files, there are only three differences, all in the positive direction, indicating less states.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Debian
Linux Kernel
Suse