In the Linux kernel, the following vulnerability has been resolved:
bpf: Defer the free of inner map when necessary
When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program or sleepable program. However bpfmapfdputptr() decreases the ref-counter of the inner map directly through bpfmapput(), if the ref-counter is the last one (which is true for most cases), the inner map will be freed by ops->mapfree() in a kworker. But for now, most .mapfree() callbacks don't use synchronizercu() or its variants to wait for the elapse of a RCU grace period, so after the invocation of ops->mapfree completes, the bpf program which is accessing the inner map may incur use-after-free problem.
Fix the free of inner map by invoking bpfmapfreedeferred() after both one RCU grace period and one tasks trace RCU grace period if the inner map has been removed from the outer map before. The deferment is accomplished by using callrcu() or callrcutaskstrace() when releasing the last ref-counter of bpf map. The newly-added rcuhead field in bpfmap shares the same storage space with work field to reduce the size of bpfmap.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f91cd728b10c51f6d4a39957ccd56d1e802fc8ee",
"target": {
"file": "include/linux/bpf.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-04d130d7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"206466624804038775115773404622721070376",
"218954169587408855324771097918133593180",
"213739264537722971556046392954925446493",
"235726827772550530672580338766156390210",
"8571337259299054848451484984027439948",
"269297388646648838013527706389232751963",
"242339216553835298791363933964035651454",
"26820022280815561966611248771809688646"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62fca83303d608ad4fec3f7428c8685680bb01b0",
"target": {
"function": "__bpf_map_put",
"file": "kernel/bpf/syscall.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-05f9d3a7",
"digest": {
"length": 262.0,
"function_hash": "304757361417262462504648718732869061433"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62fca83303d608ad4fec3f7428c8685680bb01b0",
"target": {
"file": "kernel/bpf/syscall.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-0c1215fa",
"digest": {
"threshold": 0.9,
"line_hashes": [
"120318120100658661562103379171060076235",
"69696755761562501893758268655973150202",
"331383315008710215341511719254829747296",
"305836463888037312687972516960971296283",
"325231730483990937294832508432704861280",
"314208114424285418637655005559913065893",
"142711307193123037726103180970481182956",
"314780525780142336954547238115081410428"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90c445799fd1dc214d7c6279c144e33a35e29ef2",
"target": {
"file": "kernel/bpf/map_in_map.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-0ffc13cf",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153883625828482095860593458430819703155",
"266308010999194820609422877955720437231",
"305153891646529837613448566939362971311",
"33487422032262426467185710507886389353"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@876673364161da50eed6b472d746ef88242b2368",
"target": {
"function": "bpf_map_fd_put_ptr",
"file": "kernel/bpf/map_in_map.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-10ca553f",
"digest": {
"length": 87.0,
"function_hash": "101086760150615607413799826541621976696"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37d98fb9c3144c0fddf7f6e99aece9927ac8dce6",
"target": {
"file": "include/linux/bpf.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-27f492f0",
"digest": {
"threshold": 0.9,
"line_hashes": [
"318416121092695412352244076404919137629",
"218954169587408855324771097918133593180",
"213739264537722971556046392954925446493",
"47385662239843934325149653033586431571",
"45938502342401677247904234084842794636",
"303132141724185802255476765442511309491"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f91cd728b10c51f6d4a39957ccd56d1e802fc8ee",
"target": {
"function": "bpf_map_fd_put_ptr",
"file": "kernel/bpf/map_in_map.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-28ce72dc",
"digest": {
"length": 87.0,
"function_hash": "101086760150615607413799826541621976696"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfd9b20c4862f41d4590fde11d70a5eeae53dcc5",
"target": {
"function": "bpf_map_fd_put_ptr",
"file": "kernel/bpf/map_in_map.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-2b289b80",
"digest": {
"length": 87.0,
"function_hash": "101086760150615607413799826541621976696"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37d98fb9c3144c0fddf7f6e99aece9927ac8dce6",
"target": {
"file": "kernel/bpf/syscall.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-4fa4f344",
"digest": {
"threshold": 0.9,
"line_hashes": [
"120318120100658661562103379171060076235",
"69696755761562501893758268655973150202",
"331383315008710215341511719254829747296",
"305836463888037312687972516960971296283",
"145674426767336543159261255291337965902",
"212037199690606482278412924704645507121",
"223029401972201681997466907877334702739",
"218781041314823673571272126956529055594"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f91cd728b10c51f6d4a39957ccd56d1e802fc8ee",
"target": {
"file": "kernel/bpf/syscall.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-51e219fa",
"digest": {
"threshold": 0.9,
"line_hashes": [
"208583606650430571412786383899519289709",
"264621069183765192103082920502920586146",
"305628189272169083817400766827462171497",
"94446574540145257768097101260251610647",
"318223100173308457418898011625213845501",
"314208114424285418637655005559913065893",
"142711307193123037726103180970481182956",
"318898564401242284182119965376234772923"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90c445799fd1dc214d7c6279c144e33a35e29ef2",
"target": {
"file": "include/linux/bpf.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-657a7b33",
"digest": {
"threshold": 0.9,
"line_hashes": [
"318416121092695412352244076404919137629",
"218954169587408855324771097918133593180",
"213739264537722971556046392954925446493",
"47385662239843934325149653033586431571",
"45938502342401677247904234084842794636",
"303132141724185802255476765442511309491"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90c445799fd1dc214d7c6279c144e33a35e29ef2",
"target": {
"file": "kernel/bpf/syscall.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-725cd26a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"120318120100658661562103379171060076235",
"69696755761562501893758268655973150202",
"331383315008710215341511719254829747296",
"305836463888037312687972516960971296283",
"145674426767336543159261255291337965902",
"212037199690606482278412924704645507121",
"223029401972201681997466907877334702739",
"218781041314823673571272126956529055594"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62fca83303d608ad4fec3f7428c8685680bb01b0",
"target": {
"file": "kernel/bpf/map_in_map.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-82b767ec",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153883625828482095860593458430819703155",
"266308010999194820609422877955720437231",
"305153891646529837613448566939362971311",
"33487422032262426467185710507886389353"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62fca83303d608ad4fec3f7428c8685680bb01b0",
"target": {
"file": "include/linux/bpf.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-8b6df2a6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"123504442376925866114330830398823002279",
"218954169587408855324771097918133593180",
"213739264537722971556046392954925446493",
"235726827772550530672580338766156390210",
"8571337259299054848451484984027439948",
"269297388646648838013527706389232751963",
"242339216553835298791363933964035651454",
"92529449899430779894309508017470322563"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfd9b20c4862f41d4590fde11d70a5eeae53dcc5",
"target": {
"function": "bpf_map_put",
"file": "kernel/bpf/syscall.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-991cc940",
"digest": {
"length": 233.0,
"function_hash": "34746154879384911405436490909132825284"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@876673364161da50eed6b472d746ef88242b2368",
"target": {
"function": "bpf_map_put",
"file": "kernel/bpf/syscall.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-a4c064a0",
"digest": {
"length": 233.0,
"function_hash": "34746154879384911405436490909132825284"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@876673364161da50eed6b472d746ef88242b2368",
"target": {
"file": "include/linux/bpf.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-ab05b434",
"digest": {
"threshold": 0.9,
"line_hashes": [
"206466624804038775115773404622721070376",
"218954169587408855324771097918133593180",
"213739264537722971556046392954925446493",
"235726827772550530672580338766156390210",
"8571337259299054848451484984027439948",
"269297388646648838013527706389232751963",
"242339216553835298791363933964035651454",
"26820022280815561966611248771809688646"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37d98fb9c3144c0fddf7f6e99aece9927ac8dce6",
"target": {
"function": "__bpf_map_put",
"file": "kernel/bpf/syscall.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-ade7b30e",
"digest": {
"length": 242.0,
"function_hash": "49947055479428294321021175046417219169"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@876673364161da50eed6b472d746ef88242b2368",
"target": {
"file": "kernel/bpf/syscall.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-b82bfc27",
"digest": {
"threshold": 0.9,
"line_hashes": [
"208583606650430571412786383899519289709",
"264621069183765192103082920502920586146",
"305628189272169083817400766827462171497",
"94446574540145257768097101260251610647",
"318223100173308457418898011625213845501",
"314208114424285418637655005559913065893",
"142711307193123037726103180970481182956",
"318898564401242284182119965376234772923"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90c445799fd1dc214d7c6279c144e33a35e29ef2",
"target": {
"function": "bpf_map_fd_put_ptr",
"file": "kernel/bpf/map_in_map.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-b9e69944",
"digest": {
"length": 87.0,
"function_hash": "101086760150615607413799826541621976696"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfd9b20c4862f41d4590fde11d70a5eeae53dcc5",
"target": {
"file": "kernel/bpf/syscall.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-bb32e5bc",
"digest": {
"threshold": 0.9,
"line_hashes": [
"208583606650430571412786383899519289709",
"264621069183765192103082920502920586146",
"305628189272169083817400766827462171497",
"94446574540145257768097101260251610647",
"318223100173308457418898011625213845501",
"314208114424285418637655005559913065893",
"142711307193123037726103180970481182956",
"318898564401242284182119965376234772923"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfd9b20c4862f41d4590fde11d70a5eeae53dcc5",
"target": {
"file": "include/linux/bpf.h"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-bc48a32e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"206466624804038775115773404622721070376",
"218954169587408855324771097918133593180",
"213739264537722971556046392954925446493",
"235726827772550530672580338766156390210",
"8571337259299054848451484984027439948",
"269297388646648838013527706389232751963",
"242339216553835298791363933964035651454",
"26820022280815561966611248771809688646"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@62fca83303d608ad4fec3f7428c8685680bb01b0",
"target": {
"function": "bpf_map_fd_put_ptr",
"file": "kernel/bpf/map_in_map.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-c5d0e358",
"digest": {
"length": 87.0,
"function_hash": "101086760150615607413799826541621976696"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37d98fb9c3144c0fddf7f6e99aece9927ac8dce6",
"target": {
"function": "bpf_map_fd_put_ptr",
"file": "kernel/bpf/map_in_map.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-cd670746",
"digest": {
"length": 87.0,
"function_hash": "101086760150615607413799826541621976696"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f91cd728b10c51f6d4a39957ccd56d1e802fc8ee",
"target": {
"function": "bpf_map_put",
"file": "kernel/bpf/syscall.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-ceb7aac6",
"digest": {
"length": 233.0,
"function_hash": "34746154879384911405436490909132825284"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@37d98fb9c3144c0fddf7f6e99aece9927ac8dce6",
"target": {
"file": "kernel/bpf/map_in_map.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-dc2e4a19",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153883625828482095860593458430819703155",
"266308010999194820609422877955720437231",
"305153891646529837613448566939362971311",
"33487422032262426467185710507886389353"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@90c445799fd1dc214d7c6279c144e33a35e29ef2",
"target": {
"function": "__bpf_map_put",
"file": "kernel/bpf/syscall.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-dedea804",
"digest": {
"length": 242.0,
"function_hash": "49947055479428294321021175046417219169"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@876673364161da50eed6b472d746ef88242b2368",
"target": {
"file": "kernel/bpf/map_in_map.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-f63b0846",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153883625828482095860593458430819703155",
"266308010999194820609422877955720437231",
"305153891646529837613448566939362971311",
"33487422032262426467185710507886389353"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f91cd728b10c51f6d4a39957ccd56d1e802fc8ee",
"target": {
"file": "kernel/bpf/map_in_map.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-fb8aa3de",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153883625828482095860593458430819703155",
"266308010999194820609422877955720437231",
"305153891646529837613448566939362971311",
"33487422032262426467185710507886389353"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bfd9b20c4862f41d4590fde11d70a5eeae53dcc5",
"target": {
"file": "kernel/bpf/map_in_map.c"
},
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52447-fd924037",
"digest": {
"threshold": 0.9,
"line_hashes": [
"153883625828482095860593458430819703155",
"266308010999194820609422877955720437231",
"305153891646529837613448566939362971311",
"33487422032262426467185710507886389353"
]
},
"signature_type": "Line"
}
]