{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2023-53790", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-12-08T23:58:35.274Z", "datePublished": "2025-12-09T00:00:47.025Z", "dateUpdated": "2026-08-05T09:16:00.729Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T09:16:00.729Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Zeroing allocated object from slab in bpf memory allocator\n\nCurrently the freed element in bpf memory allocator may be immediately\nreused, for htab map the reuse will reinitialize special fields in map\nvalue (e.g., bpf_spin_lock), but lookup procedure may still access\nthese special fields, and it may lead to hard-lockup as shown below:\n\n NMI backtrace for cpu 16\n CPU: 16 PID: 2574 Comm: htab.bin Tainted: G L 6.1.0+ #1\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),\n RIP: 0010:queued_spin_lock_slowpath+0x283/0x2c0\n ......\n Call Trace:\n \n copy_map_value_locked+0xb7/0x170\n bpf_map_copy_value+0x113/0x3c0\n __sys_bpf+0x1c67/0x2780\n __x64_sys_bpf+0x1c/0x20\n do_syscall_64+0x30/0x60\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\n ......\n \n\nFor htab map, just like the preallocated case, these is no need to\ninitialize these special fields in map value again once these fields\nhave been initialized. For preallocated htab map, these fields are\ninitialized through __GFP_ZERO in bpf_map_area_alloc(), so do the\nsimilar thing for non-preallocated htab in bpf memory allocator. And\nthere is no need to use __GFP_ZERO for per-cpu bpf memory allocator,\nbecause __alloc_percpu_gfp() does it implicitly." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is reached exclusively through the `bpf(2)` syscall (map create/update/delete/lookup) or through a loaded BPF program calling `bpf_obj_new()`, both of which require local access to the system. There is no remote or adjacent-network path into the BPF memory allocator.\nAC:L - The attacker controls both sides of the race — one thread issuing `BPF_MAP_LOOKUP_ELEM` with `BPF_F_LOCK` while another deletes and re-adds the same key — and `unit_free`/`unit_alloc` recycle the element off the per-CPU `free_llist` with no grace period, so reuse is deterministic and can be forced by CPU pinning. The separate uninitialized-slab exposure via `bpf_obj_new()` requires no race whatsoever.\nPR:L - Creating a non-preallocated hash map whose BTF value embeds a `bpf_spin_lock` requires `bpf_capable()` (CAP_BPF), a capability routinely delegated to unprivileged BPF agents, container workloads and systemd services rather than reserved for full root. No further authentication or map-specific access control gates the update/delete/lookup calls once the attacker holds its own map fd.\nUI:N - The attacker drives the entire sequence — map creation, the concurrent update/delete threads, and the locked lookup — from its own processes. No victim action, mount, or file open is involved.\nS:U - The corruption stays inside the kernel's own memory and the BPF subsystem's structures, with no crossing of a VM, IOMMU, or other security-authority boundary. This is a standard same-authority kernel flaw.\nC:H - Without `__GFP_ZERO`, `bpf_obj_new_impl()` handed BPF programs slab objects still holding stale kernel heap contents that the program can read wholesale and exfiltrate via ringbuf or map, a broad kernel memory disclosure. The concurrent zeroing of kptr fields racing `bpf_kptr_xchg` can additionally surface stale object references usable for further reads.\nI:H - Zeroing a live queued spinlock destroys the mutual exclusion that the verifier assumes for `bpf_list_head` and `bpf_rb_root` operations, allowing concurrent linked-list and rbtree manipulation that corrupts kernel pointers, and the non-atomic reinitialization of kptr fields can drop or duplicate references. Such heap and refcount corruption is leverageable toward arbitrary write and control-flow hijack.\nA:H - The commit documents the concrete outcome: a hard lockup with a CPU stuck indefinitely in `queued_spin_lock_slowpath` under an NMI watchdog backtrace, unrecoverable without a reboot. An unprivileged-BPF-capable attacker can trigger it repeatedly at will." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/bpf.h", "kernel/bpf/hashtab.c", "kernel/bpf/memalloc.c" ], "versions": [ { "version": "0fd7c5d43339b783ee3301a05f925d1e52ac87c9", "lessThan": "678ea18d6240299fd77d7000c8b1d7e5f274c8af", "status": "affected", "versionType": "git" }, { "version": "0fd7c5d43339b783ee3301a05f925d1e52ac87c9", "lessThan": "5d447e04290e78bdc1a3a6c321320d384e09c2f1", "status": "affected", "versionType": "git" }, { "version": "0fd7c5d43339b783ee3301a05f925d1e52ac87c9", "lessThan": "997849c4b969034e225153f41026657def66d286", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "include/linux/bpf.h", "kernel/bpf/hashtab.c", "kernel/bpf/memalloc.c" ], "versions": [ { "version": "6.1", "status": "affected" }, { "version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.16", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.2.3", "lessThanOrEqual": "6.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.16" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.2.3" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/678ea18d6240299fd77d7000c8b1d7e5f274c8af" }, { "url": "https://git.kernel.org/stable/c/5d447e04290e78bdc1a3a6c321320d384e09c2f1" }, { "url": "https://git.kernel.org/stable/c/997849c4b969034e225153f41026657def66d286" } ], "title": "bpf: Zeroing allocated object from slab in bpf memory allocator", "x_generator": { "engine": "bippy-1.2.0" } } } }