CVE-2023-54173 (GCVE-0-2023-54173)
Vulnerability from cvelistv5
Published
2025-12-30 12:08
Modified
2025-12-30 12:08
Severity ?
VLAI Severity ?
EPSS score ?
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Disable preemption in bpf_event_output
We received report [1] of kernel crash, which is caused by
using nesting protection without disabled preemption.
The bpf_event_output can be called by programs executed by
bpf_prog_run_array_cg function that disabled migration but
keeps preemption enabled.
This can cause task to be preempted by another one inside the
nesting protection and lead eventually to two tasks using same
perf_sample_data buffer and cause crashes like:
BUG: kernel NULL pointer dereference, address: 0000000000000001
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
...
? perf_output_sample+0x12a/0x9a0
? finish_task_switch.isra.0+0x81/0x280
? perf_event_output+0x66/0xa0
? bpf_event_output+0x13a/0x190
? bpf_event_output_data+0x22/0x40
? bpf_prog_dfc84bbde731b257_cil_sock4_connect+0x40a/0xacb
? xa_load+0x87/0xe0
? __cgroup_bpf_run_filter_sock_addr+0xc1/0x1a0
? release_sock+0x3e/0x90
? sk_setsockopt+0x1a1/0x12f0
? udp_pre_connect+0x36/0x50
? inet_dgram_connect+0x93/0xa0
? __sys_connect+0xb4/0xe0
? udp_setsockopt+0x27/0x40
? __pfx_udp_push_pending_frames+0x10/0x10
? __sys_setsockopt+0xdf/0x1a0
? __x64_sys_connect+0xf/0x20
? do_syscall_64+0x3a/0x90
? entry_SYSCALL_64_after_hwframe+0x72/0xdc
Fixing this by disabling preemption in bpf_event_output.
[1] https://github.com/cilium/cilium/issues/26756
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/bpf_trace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3048cb0dc0cc9dc74ed93690dffef00733bcad5b",
"status": "affected",
"version": "2a916f2f546ca1c1e3323e2a4269307f6d9890eb",
"versionType": "git"
},
{
"lessThan": "c81bdf8f9f2b002d217c3d5357cdea9f2b82ff90",
"status": "affected",
"version": "2a916f2f546ca1c1e3323e2a4269307f6d9890eb",
"versionType": "git"
},
{
"lessThan": "36dd8ca330b76585640ed32255a3c99f901e1502",
"status": "affected",
"version": "2a916f2f546ca1c1e3323e2a4269307f6d9890eb",
"versionType": "git"
},
{
"lessThan": "063c9ce8e74e07bf94f99cd13146f42867875e8b",
"status": "affected",
"version": "2a916f2f546ca1c1e3323e2a4269307f6d9890eb",
"versionType": "git"
},
{
"lessThan": "d62cc390c2e99ae267ffe4b8d7e2e08b6c758c32",
"status": "affected",
"version": "2a916f2f546ca1c1e3323e2a4269307f6d9890eb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/bpf_trace.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.190",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.126",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.190",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.126",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.45",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.10",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disable preemption in bpf_event_output\n\nWe received report [1] of kernel crash, which is caused by\nusing nesting protection without disabled preemption.\n\nThe bpf_event_output can be called by programs executed by\nbpf_prog_run_array_cg function that disabled migration but\nkeeps preemption enabled.\n\nThis can cause task to be preempted by another one inside the\nnesting protection and lead eventually to two tasks using same\nperf_sample_data buffer and cause crashes like:\n\n BUG: kernel NULL pointer dereference, address: 0000000000000001\n #PF: supervisor instruction fetch in kernel mode\n #PF: error_code(0x0010) - not-present page\n ...\n ? perf_output_sample+0x12a/0x9a0\n ? finish_task_switch.isra.0+0x81/0x280\n ? perf_event_output+0x66/0xa0\n ? bpf_event_output+0x13a/0x190\n ? bpf_event_output_data+0x22/0x40\n ? bpf_prog_dfc84bbde731b257_cil_sock4_connect+0x40a/0xacb\n ? xa_load+0x87/0xe0\n ? __cgroup_bpf_run_filter_sock_addr+0xc1/0x1a0\n ? release_sock+0x3e/0x90\n ? sk_setsockopt+0x1a1/0x12f0\n ? udp_pre_connect+0x36/0x50\n ? inet_dgram_connect+0x93/0xa0\n ? __sys_connect+0xb4/0xe0\n ? udp_setsockopt+0x27/0x40\n ? __pfx_udp_push_pending_frames+0x10/0x10\n ? __sys_setsockopt+0xdf/0x1a0\n ? __x64_sys_connect+0xf/0x20\n ? do_syscall_64+0x3a/0x90\n ? entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nFixing this by disabling preemption in bpf_event_output.\n\n[1] https://github.com/cilium/cilium/issues/26756"
}
],
"providerMetadata": {
"dateUpdated": "2025-12-30T12:08:46.842Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3048cb0dc0cc9dc74ed93690dffef00733bcad5b"
},
{
"url": "https://git.kernel.org/stable/c/c81bdf8f9f2b002d217c3d5357cdea9f2b82ff90"
},
{
"url": "https://git.kernel.org/stable/c/36dd8ca330b76585640ed32255a3c99f901e1502"
},
{
"url": "https://git.kernel.org/stable/c/063c9ce8e74e07bf94f99cd13146f42867875e8b"
},
{
"url": "https://git.kernel.org/stable/c/d62cc390c2e99ae267ffe4b8d7e2e08b6c758c32"
}
],
"title": "bpf: Disable preemption in bpf_event_output",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-54173",
"datePublished": "2025-12-30T12:08:46.842Z",
"dateReserved": "2025-12-30T12:06:44.496Z",
"dateUpdated": "2025-12-30T12:08:46.842Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-54173\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-12-30T13:16:05.157\",\"lastModified\":\"2025-12-30T13:16:05.157\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Disable preemption in bpf_event_output\\n\\nWe received report [1] of kernel crash, which is caused by\\nusing nesting protection without disabled preemption.\\n\\nThe bpf_event_output can be called by programs executed by\\nbpf_prog_run_array_cg function that disabled migration but\\nkeeps preemption enabled.\\n\\nThis can cause task to be preempted by another one inside the\\nnesting protection and lead eventually to two tasks using same\\nperf_sample_data buffer and cause crashes like:\\n\\n BUG: kernel NULL pointer dereference, address: 0000000000000001\\n #PF: supervisor instruction fetch in kernel mode\\n #PF: error_code(0x0010) - not-present page\\n ...\\n ? perf_output_sample+0x12a/0x9a0\\n ? finish_task_switch.isra.0+0x81/0x280\\n ? perf_event_output+0x66/0xa0\\n ? bpf_event_output+0x13a/0x190\\n ? bpf_event_output_data+0x22/0x40\\n ? bpf_prog_dfc84bbde731b257_cil_sock4_connect+0x40a/0xacb\\n ? xa_load+0x87/0xe0\\n ? __cgroup_bpf_run_filter_sock_addr+0xc1/0x1a0\\n ? release_sock+0x3e/0x90\\n ? sk_setsockopt+0x1a1/0x12f0\\n ? udp_pre_connect+0x36/0x50\\n ? inet_dgram_connect+0x93/0xa0\\n ? __sys_connect+0xb4/0xe0\\n ? udp_setsockopt+0x27/0x40\\n ? __pfx_udp_push_pending_frames+0x10/0x10\\n ? __sys_setsockopt+0xdf/0x1a0\\n ? __x64_sys_connect+0xf/0x20\\n ? do_syscall_64+0x3a/0x90\\n ? entry_SYSCALL_64_after_hwframe+0x72/0xdc\\n\\nFixing this by disabling preemption in bpf_event_output.\\n\\n[1] https://github.com/cilium/cilium/issues/26756\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/063c9ce8e74e07bf94f99cd13146f42867875e8b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3048cb0dc0cc9dc74ed93690dffef00733bcad5b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/36dd8ca330b76585640ed32255a3c99f901e1502\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c81bdf8f9f2b002d217c3d5357cdea9f2b82ff90\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d62cc390c2e99ae267ffe4b8d7e2e08b6c758c32\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…