fkie_cve-2023-54173
Vulnerability from fkie_nvd
Published
2025-12-30 13:16
Modified
2025-12-30 13:16
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_event_output We received report [1] of kernel crash, which is caused by using nesting protection without disabled preemption. The bpf_event_output can be called by programs executed by bpf_prog_run_array_cg function that disabled migration but keeps preemption enabled. This can cause task to be preempted by another one inside the nesting protection and lead eventually to two tasks using same perf_sample_data buffer and cause crashes like: BUG: kernel NULL pointer dereference, address: 0000000000000001 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page ... ? perf_output_sample+0x12a/0x9a0 ? finish_task_switch.isra.0+0x81/0x280 ? perf_event_output+0x66/0xa0 ? bpf_event_output+0x13a/0x190 ? bpf_event_output_data+0x22/0x40 ? bpf_prog_dfc84bbde731b257_cil_sock4_connect+0x40a/0xacb ? xa_load+0x87/0xe0 ? __cgroup_bpf_run_filter_sock_addr+0xc1/0x1a0 ? release_sock+0x3e/0x90 ? sk_setsockopt+0x1a1/0x12f0 ? udp_pre_connect+0x36/0x50 ? inet_dgram_connect+0x93/0xa0 ? __sys_connect+0xb4/0xe0 ? udp_setsockopt+0x27/0x40 ? __pfx_udp_push_pending_frames+0x10/0x10 ? __sys_setsockopt+0xdf/0x1a0 ? __x64_sys_connect+0xf/0x20 ? do_syscall_64+0x3a/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc Fixing this by disabling preemption in bpf_event_output. [1] https://github.com/cilium/cilium/issues/26756
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/063c9ce8e74e07bf94f99cd13146f42867875e8b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3048cb0dc0cc9dc74ed93690dffef00733bcad5b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/36dd8ca330b76585640ed32255a3c99f901e1502
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c81bdf8f9f2b002d217c3d5357cdea9f2b82ff90
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d62cc390c2e99ae267ffe4b8d7e2e08b6c758c32
Impacted products
Vendor Product Version


To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Disable preemption in bpf_event_output\n\nWe received report [1] of kernel crash, which is caused by\nusing nesting protection without disabled preemption.\n\nThe bpf_event_output can be called by programs executed by\nbpf_prog_run_array_cg function that disabled migration but\nkeeps preemption enabled.\n\nThis can cause task to be preempted by another one inside the\nnesting protection and lead eventually to two tasks using same\nperf_sample_data buffer and cause crashes like:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000001\n  #PF: supervisor instruction fetch in kernel mode\n  #PF: error_code(0x0010) - not-present page\n  ...\n  ? perf_output_sample+0x12a/0x9a0\n  ? finish_task_switch.isra.0+0x81/0x280\n  ? perf_event_output+0x66/0xa0\n  ? bpf_event_output+0x13a/0x190\n  ? bpf_event_output_data+0x22/0x40\n  ? bpf_prog_dfc84bbde731b257_cil_sock4_connect+0x40a/0xacb\n  ? xa_load+0x87/0xe0\n  ? __cgroup_bpf_run_filter_sock_addr+0xc1/0x1a0\n  ? release_sock+0x3e/0x90\n  ? sk_setsockopt+0x1a1/0x12f0\n  ? udp_pre_connect+0x36/0x50\n  ? inet_dgram_connect+0x93/0xa0\n  ? __sys_connect+0xb4/0xe0\n  ? udp_setsockopt+0x27/0x40\n  ? __pfx_udp_push_pending_frames+0x10/0x10\n  ? __sys_setsockopt+0xdf/0x1a0\n  ? __x64_sys_connect+0xf/0x20\n  ? do_syscall_64+0x3a/0x90\n  ? entry_SYSCALL_64_after_hwframe+0x72/0xdc\n\nFixing this by disabling preemption in bpf_event_output.\n\n[1] https://github.com/cilium/cilium/issues/26756"
    }
  ],
  "id": "CVE-2023-54173",
  "lastModified": "2025-12-30T13:16:05.157",
  "metrics": {},
  "published": "2025-12-30T13:16:05.157",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/063c9ce8e74e07bf94f99cd13146f42867875e8b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3048cb0dc0cc9dc74ed93690dffef00733bcad5b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/36dd8ca330b76585640ed32255a3c99f901e1502"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c81bdf8f9f2b002d217c3d5357cdea9f2b82ff90"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d62cc390c2e99ae267ffe4b8d7e2e08b6c758c32"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.