{"api_version":"1","generated_at":"2026-11-10T16:43:35+00:00","cve":"CVE-2023-53024","urls":{"html":"https://cve.report/CVE-2023-53024","api":"https://cve.report/api/cve/CVE-2023-53024.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-53024","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-53024"},"summary":{"title":"bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix pointer-leak due to insufficient speculative store bypass mitigation\n\nTo mitigate Spectre v4, 2039f26f3aca (\"bpf: Fix leakage due to\ninsufficient speculative store bypass mitigation\") inserts lfence\ninstructions after 1) initializing a stack slot and 2) spilling a\npointer to the stack.\n\nHowever, this does not cover cases where a stack slot is first\ninitialized with a pointer (subject to sanitization) but then\noverwritten with a scalar (not subject to sanitization because\nthe slot was already initialized). In this case, the second write\nmay be subject to speculative store bypass (SSB) creating a\nspeculative pointer-as-scalar type confusion. This allows the\nprogram to subsequently leak the numerical pointer value using,\nfor example, a branch-based cache side channel.\n\nTo fix this, also sanitize scalars if they write a stack slot\nthat previously contained a pointer. Assuming that pointer-spills\nare only generated by LLVM on register-pressure, the performance\nimpact on most real-world BPF programs should be small.\n\nThe following unprivileged BPF bytecode drafts a minimal exploit\nand the mitigation:\n\n  [...]\n  // r6 = 0 or 1 (skalar, unknown user input)\n  // r7 = accessible ptr for side channel\n  // r10 = frame pointer (fp), to be leaked\n  //\n  r9 = r10 # fp alias to encourage ssb\n  *(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked\n  // lfence added here because of pointer spill to stack.\n  //\n  // Ommitted: Dummy bpf_ringbuf_output() here to train alias predictor\n  // for no r9-r10 dependency.\n  //\n  *(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr\n  // 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID,\n  // store may be subject to SSB\n  //\n  // fix: also add an lfence when the slot contained a ptr\n  //\n  r8 = *(u64 *)(r9 - 8)\n  // r8 = architecturally a scalar, speculatively a ptr\n  //\n  // leak ptr using branch-based cache side channel:\n  r8 &= 1 // choose bit to leak\n  if r8 == 0 goto SLOW // no mispredict\n  // architecturally dead code if input r6 is 0,\n  // only executes speculatively iff ptr bit is 1\n  r8 = *(u64 *)(r7 + 0) # encode bit in cache (0: slow, 1: fast)\nSLOW:\n  [...]\n\nAfter running this, the program can time the access to *(r7 + 0) to\ndetermine whether the chosen pointer bit was 0 or 1. Repeat this 64\ntimes to recover the whole address on amd64.\n\nIn summary, sanitization can only be skipped if one scalar is\noverwritten with another scalar. Scalar-confusion due to speculative\nstore bypass can not lead to invalid accesses because the pointer\nbounds deducted during verification are enforced using branchless\nlogic. See 979d63d50c0c (\"bpf: prevent out of bounds speculation on\npointer arithmetic\") for details.\n\nDo not make the mitigation depend on !env->allow_{uninit_stack,ptr_leaks}\nbecause speculative leaks are likely unexpected if these were enabled.\nFor example, leaking the address to a protected log file may be acceptable\nwhile disabling the mitigation might unintentionally leak the address\ninto the cached-state of a map that is accessible to unprivileged\nprocesses.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-03-27 17:15:51","updated_at":"2026-11-05 21:17:07"},"problem_types":["NVD-CWE-noinfo"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"}}],"references":[{"url":"https://git.kernel.org/stable/c/da75dec7c6617bddad418159ffebcb133f008262","name":"https://git.kernel.org/stable/c/da75dec7c6617bddad418159ffebcb133f008262","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/81b3374944d201872cfcf82730a7860f8e7c31dd","name":"https://git.kernel.org/stable/c/81b3374944d201872cfcf82730a7860f8e7c31dd","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/e4f4db47794c9f474b184ee1418f42e6a07412b6","name":"https://git.kernel.org/stable/c/e4f4db47794c9f474b184ee1418f42e6a07412b6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/aae109414a57ab4164218f36e2e4a17f027fcaaa","name":"https://git.kernel.org/stable/c/aae109414a57ab4164218f36e2e4a17f027fcaaa","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528","name":"https://git.kernel.org/stable/c/01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/b0c89ef025562161242a7c19b213bd6b272e93df","name":"https://git.kernel.org/stable/c/b0c89ef025562161242a7c19b213bd6b272e93df","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-53024","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-53024","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 872968502114d68c21419cf7eb5ab97717e7b803 aae109414a57ab4164218f36e2e4a17f027fcaaa git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected f5893af2704eb763eb982f01d573f5b19f06b623 81b3374944d201872cfcf82730a7860f8e7c31dd git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0e9280654aa482088ee6ef3deadef331f5ac5fb0 da75dec7c6617bddad418159ffebcb133f008262 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2039f26f3aca5b0e419b98f65dd36481337b86ee 01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2039f26f3aca5b0e419b98f65dd36481337b86ee b0c89ef025562161242a7c19b213bd6b272e93df git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2039f26f3aca5b0e419b98f65dd36481337b86ee e4f4db47794c9f474b184ee1418f42e6a07412b6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0b27bdf02c400684225ee5ee99970bcbf5082282 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 4.19.207 4.19.272 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.4.146 5.4.231 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.10.56 5.10.166 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.13.8 5.14 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.14","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.14 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 4.19.272 4.19.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.4.231 5.4.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.166 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.91 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.9 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"53024","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2023-53024","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-11-05T20:14:43.758869Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-11-05T20:20:54.663Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"aae109414a57ab4164218f36e2e4a17f027fcaaa","status":"affected","version":"872968502114d68c21419cf7eb5ab97717e7b803","versionType":"git"},{"lessThan":"81b3374944d201872cfcf82730a7860f8e7c31dd","status":"affected","version":"f5893af2704eb763eb982f01d573f5b19f06b623","versionType":"git"},{"lessThan":"da75dec7c6617bddad418159ffebcb133f008262","status":"affected","version":"0e9280654aa482088ee6ef3deadef331f5ac5fb0","versionType":"git"},{"lessThan":"01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528","status":"affected","version":"2039f26f3aca5b0e419b98f65dd36481337b86ee","versionType":"git"},{"lessThan":"b0c89ef025562161242a7c19b213bd6b272e93df","status":"affected","version":"2039f26f3aca5b0e419b98f65dd36481337b86ee","versionType":"git"},{"lessThan":"e4f4db47794c9f474b184ee1418f42e6a07412b6","status":"affected","version":"2039f26f3aca5b0e419b98f65dd36481337b86ee","versionType":"git"},{"status":"affected","version":"0b27bdf02c400684225ee5ee99970bcbf5082282","versionType":"git"},{"lessThan":"4.19.272","status":"affected","version":"4.19.207","versionType":"semver"},{"lessThan":"5.4.231","status":"affected","version":"5.4.146","versionType":"semver"},{"lessThan":"5.10.166","status":"affected","version":"5.10.56","versionType":"semver"},{"lessThan":"5.14","status":"affected","version":"5.13.8","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["kernel/bpf/verifier.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.14"},{"lessThan":"5.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"4.19.*","status":"unaffected","version":"4.19.272","versionType":"semver"},{"lessThanOrEqual":"5.4.*","status":"unaffected","version":"5.4.231","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.166","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.91","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.9","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"4.19.272","versionStartIncluding":"4.19.207","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.4.231","versionStartIncluding":"5.4.146","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.166","versionStartIncluding":"5.10.56","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.91","versionStartIncluding":"5.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.9","versionStartIncluding":"5.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.2","versionStartIncluding":"5.14","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13.8","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix pointer-leak due to insufficient speculative store bypass mitigation\n\nTo mitigate Spectre v4, 2039f26f3aca (\"bpf: Fix leakage due to\ninsufficient speculative store bypass mitigation\") inserts lfence\ninstructions after 1) initializing a stack slot and 2) spilling a\npointer to the stack.\n\nHowever, this does not cover cases where a stack slot is first\ninitialized with a pointer (subject to sanitization) but then\noverwritten with a scalar (not subject to sanitization because\nthe slot was already initialized). In this case, the second write\nmay be subject to speculative store bypass (SSB) creating a\nspeculative pointer-as-scalar type confusion. This allows the\nprogram to subsequently leak the numerical pointer value using,\nfor example, a branch-based cache side channel.\n\nTo fix this, also sanitize scalars if they write a stack slot\nthat previously contained a pointer. Assuming that pointer-spills\nare only generated by LLVM on register-pressure, the performance\nimpact on most real-world BPF programs should be small.\n\nThe following unprivileged BPF bytecode drafts a minimal exploit\nand the mitigation:\n\n  [...]\n  // r6 = 0 or 1 (skalar, unknown user input)\n  // r7 = accessible ptr for side channel\n  // r10 = frame pointer (fp), to be leaked\n  //\n  r9 = r10 # fp alias to encourage ssb\n  *(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked\n  // lfence added here because of pointer spill to stack.\n  //\n  // Ommitted: Dummy bpf_ringbuf_output() here to train alias predictor\n  // for no r9-r10 dependency.\n  //\n  *(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr\n  // 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID,\n  // store may be subject to SSB\n  //\n  // fix: also add an lfence when the slot contained a ptr\n  //\n  r8 = *(u64 *)(r9 - 8)\n  // r8 = architecturally a scalar, speculatively a ptr\n  //\n  // leak ptr using branch-based cache side channel:\n  r8 &= 1 // choose bit to leak\n  if r8 == 0 goto SLOW // no mispredict\n  // architecturally dead code if input r6 is 0,\n  // only executes speculatively iff ptr bit is 1\n  r8 = *(u64 *)(r7 + 0) # encode bit in cache (0: slow, 1: fast)\nSLOW:\n  [...]\n\nAfter running this, the program can time the access to *(r7 + 0) to\ndetermine whether the chosen pointer bit was 0 or 1. Repeat this 64\ntimes to recover the whole address on amd64.\n\nIn summary, sanitization can only be skipped if one scalar is\noverwritten with another scalar. Scalar-confusion due to speculative\nstore bypass can not lead to invalid accesses because the pointer\nbounds deducted during verification are enforced using branchless\nlogic. See 979d63d50c0c (\"bpf: prevent out of bounds speculation on\npointer arithmetic\") for details.\n\nDo not make the mitigation depend on !env->allow_{uninit_stack,ptr_leaks}\nbecause speculative leaks are likely unexpected if these were enabled.\nFor example, leaking the address to a protected log file may be acceptable\nwhile disabling the mitigation might unintentionally leak the address\ninto the cached-state of a map that is accessible to unprivileged\nprocesses."}],"providerMetadata":{"dateUpdated":"2026-05-23T15:27:44.578Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/aae109414a57ab4164218f36e2e4a17f027fcaaa"},{"url":"https://git.kernel.org/stable/c/81b3374944d201872cfcf82730a7860f8e7c31dd"},{"url":"https://git.kernel.org/stable/c/da75dec7c6617bddad418159ffebcb133f008262"},{"url":"https://git.kernel.org/stable/c/01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528"},{"url":"https://git.kernel.org/stable/c/b0c89ef025562161242a7c19b213bd6b272e93df"},{"url":"https://git.kernel.org/stable/c/e4f4db47794c9f474b184ee1418f42e6a07412b6"}],"title":"bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2023-53024","datePublished":"2025-03-27T16:43:49.824Z","dateReserved":"2025-03-27T16:40:15.753Z","dateUpdated":"2026-11-05T20:20:54.663Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-03-27 17:15:51","lastModifiedDate":"2026-11-05 21:17:07","problem_types":["NVD-CWE-noinfo"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-11-05T20:14:43.758869Z","id":"CVE-2023-53024","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.207","versionEndExcluding":"4.19.272","matchCriteriaId":"24AAC99F-8574-4730-97EF-8D151F18C754"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.146","versionEndExcluding":"5.4.231","matchCriteriaId":"1EEDBA35-16D7-4B98-9EAF-B23478991256"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.56","versionEndExcluding":"5.10.166","matchCriteriaId":"9AF02AD4-5803-4A72-9C08-8AE328ACE92D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13.8","versionEndExcluding":"5.14","matchCriteriaId":"36EE71C6-4B88-4A86-A5C2-2ED3CE3D73C1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14.1","versionEndExcluding":"5.15.91","matchCriteriaId":"ABD7378E-DD3E-4737-8A11-D5989C6D9B38"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.9","matchCriteriaId":"ED5B6045-B1D2-4E03-B194-9005A351BCAE"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.14:-:*:*:*:*:*:*","matchCriteriaId":"6A05198E-F8FA-4517-8D0E-8C95066AED38"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.14:rc4:*:*:*:*:*:*","matchCriteriaId":"D1DA0AF6-02F4-47C7-A318-8C006ED0C665"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.14:rc5:*:*:*:*:*:*","matchCriteriaId":"49DD30B1-8C99-4C38-A66B-CAB3827BEE8A"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.14:rc6:*:*:*:*:*:*","matchCriteriaId":"15013998-4AF0-4CDC-AB13-829ECD8A8E66"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:5.14:rc7:*:*:*:*:*:*","matchCriteriaId":"376A25CF-C05B-48F1-99B1-8FB0314A8E06"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*","matchCriteriaId":"FF501633-2F44-4913-A8EE-B021929F49F6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*","matchCriteriaId":"2BDA597B-CAC1-4DF0-86F0-42E142C654E9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*","matchCriteriaId":"725C78C9-12CE-406F-ABE8-0813A01D66E8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:6.2:rc4:*:*:*:*:*:*","matchCriteriaId":"A127C155-689C-4F67-B146-44A57F4BFD85"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2023","CveId":"53024","Ordinal":"1","Title":"bpf: Fix pointer-leak due to insufficient speculative store bypa","CVE":"CVE-2023-53024","Year":"2023"},"notes":[{"CveYear":"2023","CveId":"53024","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix pointer-leak due to insufficient speculative store bypass mitigation\n\nTo mitigate Spectre v4, 2039f26f3aca (\"bpf: Fix leakage due to\ninsufficient speculative store bypass mitigation\") inserts lfence\ninstructions after 1) initializing a stack slot and 2) spilling a\npointer to the stack.\n\nHowever, this does not cover cases where a stack slot is first\ninitialized with a pointer (subject to sanitization) but then\noverwritten with a scalar (not subject to sanitization because\nthe slot was already initialized). In this case, the second write\nmay be subject to speculative store bypass (SSB) creating a\nspeculative pointer-as-scalar type confusion. This allows the\nprogram to subsequently leak the numerical pointer value using,\nfor example, a branch-based cache side channel.\n\nTo fix this, also sanitize scalars if they write a stack slot\nthat previously contained a pointer. Assuming that pointer-spills\nare only generated by LLVM on register-pressure, the performance\nimpact on most real-world BPF programs should be small.\n\nThe following unprivileged BPF bytecode drafts a minimal exploit\nand the mitigation:\n\n  [...]\n  // r6 = 0 or 1 (skalar, unknown user input)\n  // r7 = accessible ptr for side channel\n  // r10 = frame pointer (fp), to be leaked\n  //\n  r9 = r10 # fp alias to encourage ssb\n  *(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked\n  // lfence added here because of pointer spill to stack.\n  //\n  // Ommitted: Dummy bpf_ringbuf_output() here to train alias predictor\n  // for no r9-r10 dependency.\n  //\n  *(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr\n  // 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID,\n  // store may be subject to SSB\n  //\n  // fix: also add an lfence when the slot contained a ptr\n  //\n  r8 = *(u64 *)(r9 - 8)\n  // r8 = architecturally a scalar, speculatively a ptr\n  //\n  // leak ptr using branch-based cache side channel:\n  r8 &= 1 // choose bit to leak\n  if r8 == 0 goto SLOW // no mispredict\n  // architecturally dead code if input r6 is 0,\n  // only executes speculatively iff ptr bit is 1\n  r8 = *(u64 *)(r7 + 0) # encode bit in cache (0: slow, 1: fast)\nSLOW:\n  [...]\n\nAfter running this, the program can time the access to *(r7 + 0) to\ndetermine whether the chosen pointer bit was 0 or 1. Repeat this 64\ntimes to recover the whole address on amd64.\n\nIn summary, sanitization can only be skipped if one scalar is\noverwritten with another scalar. Scalar-confusion due to speculative\nstore bypass can not lead to invalid accesses because the pointer\nbounds deducted during verification are enforced using branchless\nlogic. See 979d63d50c0c (\"bpf: prevent out of bounds speculation on\npointer arithmetic\") for details.\n\nDo not make the mitigation depend on !env->allow_{uninit_stack,ptr_leaks}\nbecause speculative leaks are likely unexpected if these were enabled.\nFor example, leaking the address to a protected log file may be acceptable\nwhile disabling the mitigation might unintentionally leak the address\ninto the cached-state of a map that is accessible to unprivileged\nprocesses.","Type":"Description","Title":"bpf: Fix pointer-leak due to insufficient speculative store bypa"}]}}}