In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix accesses to uninit stack slots
Privileged programs are supposed to be able to read uninitialized stack memory (ever since 6715df8d5) but, before this patch, these accesses were permitted inconsistently. In particular, accesses were permitted above state->allocatedstack, but not below it. In other words, if the stack was already "large enough", the access was permitted, but otherwise the access was rejected instead of being allowed to "grow the stack". This undesired rejection was happening in two places: - in checkstackslotwithinbounds() - in checkstackrangeinitialized() This patch arranges for these accesses to be permitted. A bunch of tests that were relying on the old rejection had to change; all of them were changed to add also run unprivileged, in which case the old behavior persists. One tests couldn't be updated - global_func16 - because it can't run unprivileged for other reasons.
This patch also fixes the tracking of the stack size for variable-offset reads. This second fix is bundled in the same commit as the first one because they're inter-related. Before this patch, writes to the stack using registers containing a variable offset (as opposed to registers with fixed, known values) were not properly contributing to the function's needed stack size. As a result, it was possible for a program to verify, but then to attempt to read out-of-bounds data at runtime because a too small stack had been allocated for it.
Each function tracks the size of the stack it needs in bpfsubproginfo.stackdepth, which is maintained by updatestackdepth(). For regular memory accesses, checkmemaccess() was calling updatestate_depth() but it was passing in only the fixed part of the offset register, ignoring the variable offset. This was incorrect; the minimum possible value of that register should be used instead.
This tracking is now fixed by centralizing the tracking of stack size in growstackstate(), and by lifting the calls to growstackstate() to checkstackaccesswithinbounds() as suggested by Andrii. The code is now simpler and more convincingly tracks the correct maximum stack size. checkstackrange_initialized() can now rely on enough stack having been allocated for the access; this helps with the fix for the first issue.
A few tests were changed to also check the stack depth computation. The one that fails without this patch is verifiervaroff:stackwriteprivvsunpriv.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"function": "check_stack_write_fixed_off",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-04d2acc5",
"digest": {
"function_hash": "171560276674167172082382150176815206827",
"length": 2748.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"function": "check_stack_slot_within_bounds",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-055604f1",
"digest": {
"function_hash": "135619869972277123169989516005584098425",
"length": 236.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"function": "grow_stack_state",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-059cd990",
"digest": {
"function_hash": "310132763565527317805633719618917106565",
"length": 335.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"function": "delayed_precision_mark",
"file": "tools/testing/selftests/bpf/progs/iters.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-19551dc4",
"digest": {
"function_hash": "324253441109222508413765757765652695363",
"length": 807.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"file": "tools/testing/selftests/bpf/progs/verifier_raw_stack.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-1c653c51",
"digest": {
"line_hashes": [
"186124587667494228159697133990179497852",
"191410742381785480280324944996812968991",
"125414820830368314594531591153852362460",
"41053797361917770830148938377169152873",
"322375372310322715022336274473426115197",
"325061003881594579021412441338587538592"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"function": "check_stack_write_var_off",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-1d77495c",
"digest": {
"function_hash": "118753272999693932392587153238897068668",
"length": 1749.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"function": "check_stack_access_within_bounds",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-224a7ac3",
"digest": {
"function_hash": "225937361638905555200306082733238347232",
"length": 1215.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"file": "tools/testing/selftests/bpf/verifier/calls.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-2cbaa988",
"digest": {
"line_hashes": [
"174074397309224455858353571712324033437",
"197971437982657163081436257067357647373",
"88862279731434574583933920645710430640",
"230920655611570007084912150394339049362"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"function": "stack_write_priv_vs_unpriv",
"file": "tools/testing/selftests/bpf/progs/verifier_var_off.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-2f2b69f9",
"digest": {
"function_hash": "320014859330501288137928962148598934526",
"length": 775.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"function": "check_mem_access",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-339f91d7",
"digest": {
"function_hash": "267136072368588533187249698749353734944",
"length": 6185.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"function": "check_mem_access",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-353be751",
"digest": {
"function_hash": "267136072368588533187249698749353734944",
"length": 6185.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"file": "tools/testing/selftests/bpf/progs/verifier_int_ptr.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-3581ab02",
"digest": {
"line_hashes": [
"136646817107784005035710617423417569114",
"196455838954528407590950420676406212085",
"213917920512903805623896160313151726603",
"239633827112697071364591913692246753887",
"293347756770532870358560130824526543756",
"207147353637677629988769363072467802502"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-3b992be0",
"digest": {
"line_hashes": [
"132089064856186718323124746638937632051",
"235802345398254074421946989319759261032",
"264305848743808262564824436147611619311",
"241927854963847075551702698397780788614",
"299501484442715949578565282951869123051",
"194601935861261333783691760953664320451",
"40273121171796450306049588954309736082",
"49328891348044449649538759806793604208",
"334847059752406920369786910155854447009",
"292952321997416571729318343694636474298",
"47163152482657174293038336199310103442",
"85990192966394912037572961773638008916",
"148276538156686686223668674272353162608",
"248442006051796994463666078778386241314",
"328050958737638615647845549558184401078",
"215378903515493857211182169416620890342",
"52902683349882878176540530739022247608",
"113674931603093381635949965425051517079",
"182993772720000779926527992414165841535",
"122111218086740586320505719800001773980",
"281021220288555582160616974606926409056",
"236118016556750630752766763459989620551",
"76289415413841132342589048476585101362",
"681816310790168433873059854389230609",
"327401315465620336503501646067934490428",
"81477777518636609335339592809357213080",
"291421625737222896109059292197923701776",
"336343540339164865674942289787359885748",
"175838451165073723495721525904353440251",
"210171456707403515485448358781589634043",
"206115786887738381889746617334715332953",
"302973293850196037234752340280060958060",
"302136745578447644043433139671955715705",
"59543060870043657966737568394944421836",
"27669022794298414410158327961058045495",
"172255238075583212120540403359943440805",
"338124809129837841341171241272405033911",
"191106835618088238293428976886051004967",
"92004429637240597257866544809564899305",
"322806417984188377597478179728124469680",
"339716773247842565467366006727137307113",
"198002828353566223129482162155943663858",
"135397310155632429106497518941336593062",
"252356853676249667161073134824286915475",
"53677520149098333124396782642739785322",
"224759529269156502082776634874522129150",
"119574890795820035921650264426315752831",
"196161963293346342145444855506135032647",
"57479806583406424027665493304903962509",
"335262093353938068893257561734285562251",
"104969440163989146135243658530125137343",
"181638467427324201026245809497335120045",
"262816958439909716762929098494261947586",
"162378583241412095377120725427254027490",
"55213953885027277784696558626406964916",
"248183523460197438411934852750960105047",
"228292484703118445050780616240411558601",
"127611249243932410663599800934998541324",
"110655311980953805282694165569837986510",
"273776419294310233929905055811453681489",
"12011761046695985760999710429696309126",
"174029557994636752933525365860581690571",
"305609612348545427728128338144119297319",
"327731246370167621813518442475581040958",
"333002970036906563756120734416052746537",
"336934176334341808987353957291536516541",
"259752046475339093586392625622485365973",
"98449729408523393744365654816069005769",
"68157850779179740006462014354681164010",
"14396553259675960248622360905530135039",
"27961620510103714956335430400659104107",
"257684483653022491345302596065940324417",
"82905608682703643240276055515545122043",
"316722618895401233459761817784385218820",
"250257954740603695101005725129071989571",
"312070487779524215276110215325636573004",
"8394080019733795536875005065258146332",
"328524353251530976444728724793216633546",
"116560571893699650681772131590293932462"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"function": "check_stack_slot_within_bounds",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-3cb21da2",
"digest": {
"function_hash": "135619869972277123169989516005584098425",
"length": 236.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"function": "check_mem_access",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-3dbe7b49",
"digest": {
"function_hash": "267136072368588533187249698749353734944",
"length": 6185.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"function": "update_stack_depth",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-3f972dd5",
"digest": {
"function_hash": "222063948387767330609420211231927959439",
"length": 267.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"file": "tools/testing/selftests/bpf/progs/verifier_raw_stack.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-40c19b56",
"digest": {
"line_hashes": [
"186124587667494228159697133990179497852",
"191410742381785480280324944996812968991",
"125414820830368314594531591153852362460",
"41053797361917770830148938377169152873",
"322375372310322715022336274473426115197",
"325061003881594579021412441338587538592"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"function": "check_stack_write_fixed_off",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-4ca727fe",
"digest": {
"function_hash": "305198477174695983936544826071101684953",
"length": 2773.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"function": "check_stack_access_within_bounds",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-5312aadd",
"digest": {
"function_hash": "85434596716548795175903265415563885490",
"length": 1230.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"function": "check_stack_write_var_off",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-5367c5fc",
"digest": {
"function_hash": "118753272999693932392587153238897068668",
"length": 1749.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"file": "tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-53b34933",
"digest": {
"line_hashes": [
"230967588903742634590802167434671650016",
"249632647736747177456949484361764909828",
"266886193147361856258799168351555212040",
"214504442397693514167729413938022920837",
"229852729449954532100612245401706898462",
"100774011353643330765672170785908637995",
"265014323399239305191108005238727683524",
"195750133072954997824415972254424713277",
"272504666563509279854270445428959774698",
"134184429581707396153847292694777017050",
"16649782201415787779663685329076252331",
"127185530122079803589778200843716348651",
"237006680015935583086739881497485755387",
"27551470514277282219454823162008733325"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"function": "check_stack_range_initialized",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-55301b4a",
"digest": {
"function_hash": "17847648173580483573564389183970445523",
"length": 2801.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"function": "update_stack_depth",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-5553c34e",
"digest": {
"function_hash": "222063948387767330609420211231927959439",
"length": 267.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"function": "grow_stack_state",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-56e54a42",
"digest": {
"function_hash": "310132763565527317805633719618917106565",
"length": 335.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"file": "tools/testing/selftests/bpf/progs/test_global_func16.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-63e4bb81",
"digest": {
"line_hashes": [
"47837387166714136485629711938928591467",
"332281779431665022810165522243615630978",
"303956725142876168034955716877039116289",
"140637480459555867686965630301646305906"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"function": "check_stack_access_within_bounds",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-69561d5e",
"digest": {
"function_hash": "225937361638905555200306082733238347232",
"length": 1215.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"function": "update_stack_depth",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-6c10119d",
"digest": {
"function_hash": "222063948387767330609420211231927959439",
"length": 267.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"file": "tools/testing/selftests/bpf/progs/verifier_var_off.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-75e104eb",
"digest": {
"line_hashes": [
"66876871535197506509812299920733656625",
"38984985323082288929776500343443173660",
"7092828468685082384549712384598371150",
"192835493023765138461306563267095641420",
"122209717319122155317455734315481779157",
"93812840654188944149568421067785233061",
"76256232349463738583333739105331258752",
"43094239906795924594846448964557540434",
"249036775865153429401321702929361378590",
"317923133404787939469422653256198862169",
"202207555052262756495605879434460194416",
"263418649607512893949367695983566312095",
"338767514449813300434579599535566053181",
"263381966162901366298434632429454894203",
"286427953563114638839318683369383851781",
"148926909600700863480307464733984616658",
"215175565585336327501412209815861990967",
"301314107055223123314904473148328991502",
"213314512834208968377785193511517054992",
"250130215960214121106805523703147832944",
"283413202959393060687718244254918093501"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"function": "check_stack_write_var_off",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-783c9394",
"digest": {
"function_hash": "118753272999693932392587153238897068668",
"length": 1749.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"file": "tools/testing/selftests/bpf/verifier/calls.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-805323af",
"digest": {
"line_hashes": [
"174074397309224455858353571712324033437",
"197971437982657163081436257067357647373",
"88862279731434574583933920645710430640",
"230920655611570007084912150394339049362"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"file": "tools/testing/selftests/bpf/progs/iters.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-8ac0ef1b",
"digest": {
"line_hashes": [
"298360986700104913255506594728488806271",
"70892012051506276420152150085600791443",
"155386542963053082291985150222874387629"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"function": "check_stack_range_initialized",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-96731d7c",
"digest": {
"function_hash": "17847648173580483573564389183970445523",
"length": 2801.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"file": "tools/testing/selftests/bpf/progs/verifier_var_off.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-9837cf11",
"digest": {
"line_hashes": [
"66876871535197506509812299920733656625",
"38984985323082288929776500343443173660",
"7092828468685082384549712384598371150",
"192835493023765138461306563267095641420",
"122209717319122155317455734315481779157",
"93812840654188944149568421067785233061",
"76256232349463738583333739105331258752",
"43094239906795924594846448964557540434",
"249036775865153429401321702929361378590",
"317923133404787939469422653256198862169",
"202207555052262756495605879434460194416",
"263418649607512893949367695983566312095",
"338767514449813300434579599535566053181",
"263381966162901366298434632429454894203",
"286427953563114638839318683369383851781",
"148926909600700863480307464733984616658",
"215175565585336327501412209815861990967",
"301314107055223123314904473148328991502",
"213314512834208968377785193511517054992",
"250130215960214121106805523703147832944",
"283413202959393060687718244254918093501"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"function": "grow_stack_state",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-a1fc1b52",
"digest": {
"function_hash": "310132763565527317805633719618917106565",
"length": 335.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"function": "delayed_precision_mark",
"file": "tools/testing/selftests/bpf/progs/iters.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-a2ec7ab3",
"digest": {
"function_hash": "324253441109222508413765757765652695363",
"length": 807.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"function": "check_stack_write_fixed_off",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-ab21000f",
"digest": {
"function_hash": "171560276674167172082382150176815206827",
"length": 2748.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"file": "tools/testing/selftests/bpf/progs/verifier_var_off.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-abf81471",
"digest": {
"line_hashes": [
"66876871535197506509812299920733656625",
"38984985323082288929776500343443173660",
"7092828468685082384549712384598371150",
"192835493023765138461306563267095641420",
"122209717319122155317455734315481779157",
"93812840654188944149568421067785233061",
"76256232349463738583333739105331258752",
"43094239906795924594846448964557540434",
"249036775865153429401321702929361378590",
"317923133404787939469422653256198862169",
"202207555052262756495605879434460194416",
"263418649607512893949367695983566312095",
"338767514449813300434579599535566053181",
"263381966162901366298434632429454894203",
"286427953563114638839318683369383851781",
"148926909600700863480307464733984616658",
"215175565585336327501412209815861990967",
"301314107055223123314904473148328991502",
"213314512834208968377785193511517054992",
"250130215960214121106805523703147832944",
"283413202959393060687718244254918093501"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"function": "check_stack_range_initialized",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-ac6f169f",
"digest": {
"function_hash": "17847648173580483573564389183970445523",
"length": 2801.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"file": "tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-b01f95b3",
"digest": {
"line_hashes": [
"230967588903742634590802167434671650016",
"249632647736747177456949484361764909828",
"266886193147361856258799168351555212040",
"214504442397693514167729413938022920837",
"229852729449954532100612245401706898462",
"100774011353643330765672170785908637995",
"265014323399239305191108005238727683524",
"195750133072954997824415972254424713277",
"272504666563509279854270445428959774698",
"134184429581707396153847292694777017050",
"16649782201415787779663685329076252331",
"127185530122079803589778200843716348651",
"237006680015935583086739881497485755387",
"27551470514277282219454823162008733325"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"file": "tools/testing/selftests/bpf/progs/verifier_basic_stack.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-b140a01c",
"digest": {
"line_hashes": [
"293992134898797694592795005806555116041",
"210965580631776955067227425659255089937",
"28758506422671640501434824571306504107",
"19258381469245271527062061791829499865",
"250752379342516936450410380596200930085",
"205579259442480066340366119033563618456",
"197179814324963802049178363551749800398",
"281266381754431448410786642833437400554",
"87277308427706994058369488460721964052",
"315033928939056696463663021993000775716"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"file": "tools/testing/selftests/bpf/progs/verifier_int_ptr.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-baecdc2a",
"digest": {
"line_hashes": [
"136646817107784005035710617423417569114",
"196455838954528407590950420676406212085",
"213917920512903805623896160313151726603",
"239633827112697071364591913692246753887",
"293347756770532870358560130824526543756",
"207147353637677629988769363072467802502"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"file": "tools/testing/selftests/bpf/progs/verifier_basic_stack.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-be0b8399",
"digest": {
"line_hashes": [
"293992134898797694592795005806555116041",
"210965580631776955067227425659255089937",
"28758506422671640501434824571306504107",
"19258381469245271527062061791829499865",
"250752379342516936450410380596200930085",
"205579259442480066340366119033563618456",
"197179814324963802049178363551749800398",
"281266381754431448410786642833437400554",
"87277308427706994058369488460721964052",
"315033928939056696463663021993000775716"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"file": "tools/testing/selftests/bpf/verifier/calls.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-c08b49dc",
"digest": {
"line_hashes": [
"174074397309224455858353571712324033437",
"197971437982657163081436257067357647373",
"88862279731434574583933920645710430640",
"230920655611570007084912150394339049362"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"file": "tools/testing/selftests/bpf/progs/verifier_int_ptr.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-c2f6af87",
"digest": {
"line_hashes": [
"136646817107784005035710617423417569114",
"196455838954528407590950420676406212085",
"213917920512903805623896160313151726603",
"239633827112697071364591913692246753887",
"293347756770532870358560130824526543756",
"207147353637677629988769363072467802502"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"file": "tools/testing/selftests/bpf/progs/test_global_func16.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-c6009cd3",
"digest": {
"line_hashes": [
"47837387166714136485629711938928591467",
"332281779431665022810165522243615630978",
"303956725142876168034955716877039116289",
"140637480459555867686965630301646305906"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"function": "stack_write_priv_vs_unpriv",
"file": "tools/testing/selftests/bpf/progs/verifier_var_off.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-cafbcef9",
"digest": {
"function_hash": "320014859330501288137928962148598934526",
"length": 775.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"function": "stack_write_priv_vs_unpriv",
"file": "tools/testing/selftests/bpf/progs/verifier_var_off.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-cfa49225",
"digest": {
"function_hash": "320014859330501288137928962148598934526",
"length": 775.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"file": "tools/testing/selftests/bpf/progs/test_global_func16.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-d09e1391",
"digest": {
"line_hashes": [
"47837387166714136485629711938928591467",
"332281779431665022810165522243615630978",
"303956725142876168034955716877039116289",
"140637480459555867686965630301646305906"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-d67d719b",
"digest": {
"line_hashes": [
"132089064856186718323124746638937632051",
"235802345398254074421946989319759261032",
"264305848743808262564824436147611619311",
"241927854963847075551702698397780788614",
"299501484442715949578565282951869123051",
"194601935861261333783691760953664320451",
"40273121171796450306049588954309736082",
"49328891348044449649538759806793604208",
"334847059752406920369786910155854447009",
"292952321997416571729318343694636474298",
"47163152482657174293038336199310103442",
"85990192966394912037572961773638008916",
"148276538156686686223668674272353162608",
"248442006051796994463666078778386241314",
"328050958737638615647845549558184401078",
"215378903515493857211182169416620890342",
"52902683349882878176540530739022247608",
"113674931603093381635949965425051517079",
"182993772720000779926527992414165841535",
"122111218086740586320505719800001773980",
"281021220288555582160616974606926409056",
"236118016556750630752766763459989620551",
"76289415413841132342589048476585101362",
"681816310790168433873059854389230609",
"327401315465620336503501646067934490428",
"81477777518636609335339592809357213080",
"291421625737222896109059292197923701776",
"336343540339164865674942289787359885748",
"175838451165073723495721525904353440251",
"210171456707403515485448358781589634043",
"206115786887738381889746617334715332953",
"302973293850196037234752340280060958060",
"302136745578447644043433139671955715705",
"59543060870043657966737568394944421836",
"27669022794298414410158327961058045495",
"172255238075583212120540403359943440805",
"338124809129837841341171241272405033911",
"191106835618088238293428976886051004967",
"92004429637240597257866544809564899305",
"322806417984188377597478179728124469680",
"339716773247842565467366006727137307113",
"198002828353566223129482162155943663858",
"135397310155632429106497518941336593062",
"252356853676249667161073134824286915475",
"53677520149098333124396782642739785322",
"224759529269156502082776634874522129150",
"119574890795820035921650264426315752831",
"196161963293346342145444855506135032647",
"57479806583406424027665493304903962509",
"335262093353938068893257561734285562251",
"104969440163989146135243658530125137343",
"181638467427324201026245809497335120045",
"262816958439909716762929098494261947586",
"162378583241412095377120725427254027490",
"55213953885027277784696558626406964916",
"248183523460197438411934852750960105047",
"228292484703118445050780616240411558601",
"127611249243932410663599800934998541324",
"110655311980953805282694165569837986510",
"273776419294310233929905055811453681489",
"12011761046695985760999710429696309126",
"174029557994636752933525365860581690571",
"305609612348545427728128338144119297319",
"327731246370167621813518442475581040958",
"333002970036906563756120734416052746537",
"336934176334341808987353957291536516541",
"259752046475339093586392625622485365973",
"98449729408523393744365654816069005769",
"68157850779179740006462014354681164010",
"14396553259675960248622360905530135039",
"27961620510103714956335430400659104107",
"257684483653022491345302596065940324417",
"82905608682703643240276055515545122043",
"316722618895401233459761817784385218820",
"250257954740603695101005725129071989571",
"312070487779524215276110215325636573004",
"8394080019733795536875005065258146332",
"328524353251530976444728724793216633546",
"116560571893699650681772131590293932462"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-df3d04ff",
"digest": {
"line_hashes": [
"132089064856186718323124746638937632051",
"235802345398254074421946989319759261032",
"264305848743808262564824436147611619311",
"241927854963847075551702698397780788614",
"299501484442715949578565282951869123051",
"194601935861261333783691760953664320451",
"40273121171796450306049588954309736082",
"49328891348044449649538759806793604208",
"210833820797520655665158865904266735579",
"92776075967969422494833975436057408652",
"99877872342866270135214423497341228741",
"85990192966394912037572961773638008916",
"148276538156686686223668674272353162608",
"248442006051796994463666078778386241314",
"328050958737638615647845549558184401078",
"215378903515493857211182169416620890342",
"52902683349882878176540530739022247608",
"113674931603093381635949965425051517079",
"182993772720000779926527992414165841535",
"122111218086740586320505719800001773980",
"281021220288555582160616974606926409056",
"236118016556750630752766763459989620551",
"76289415413841132342589048476585101362",
"681816310790168433873059854389230609",
"327401315465620336503501646067934490428",
"81477777518636609335339592809357213080",
"291421625737222896109059292197923701776",
"336343540339164865674942289787359885748",
"175838451165073723495721525904353440251",
"210171456707403515485448358781589634043",
"206115786887738381889746617334715332953",
"302973293850196037234752340280060958060",
"302136745578447644043433139671955715705",
"59543060870043657966737568394944421836",
"27669022794298414410158327961058045495",
"172255238075583212120540403359943440805",
"338124809129837841341171241272405033911",
"191106835618088238293428976886051004967",
"92004429637240597257866544809564899305",
"322806417984188377597478179728124469680",
"339716773247842565467366006727137307113",
"198002828353566223129482162155943663858",
"135397310155632429106497518941336593062",
"252356853676249667161073134824286915475",
"53677520149098333124396782642739785322",
"224759529269156502082776634874522129150",
"177964107770308051686003483219912821176",
"140255301100028064109356078962682741056",
"291406242680514685983278425406470150222",
"335262093353938068893257561734285562251",
"104969440163989146135243658530125137343",
"181638467427324201026245809497335120045",
"262816958439909716762929098494261947586",
"162378583241412095377120725427254027490",
"55213953885027277784696558626406964916",
"248183523460197438411934852750960105047",
"228292484703118445050780616240411558601",
"127611249243932410663599800934998541324",
"110655311980953805282694165569837986510",
"273776419294310233929905055811453681489",
"12011761046695985760999710429696309126",
"174029557994636752933525365860581690571",
"305609612348545427728128338144119297319",
"327731246370167621813518442475581040958",
"333002970036906563756120734416052746537",
"336934176334341808987353957291536516541",
"259752046475339093586392625622485365973",
"98449729408523393744365654816069005769",
"68157850779179740006462014354681164010",
"14396553259675960248622360905530135039",
"27961620510103714956335430400659104107",
"257684483653022491345302596065940324417",
"82905608682703643240276055515545122043",
"316722618895401233459761817784385218820",
"250257954740603695101005725129071989571",
"312070487779524215276110215325636573004",
"8394080019733795536875005065258146332",
"328524353251530976444728724793216633546",
"116560571893699650681772131590293932462"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"file": "tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-e0e16a3e",
"digest": {
"line_hashes": [
"230967588903742634590802167434671650016",
"249632647736747177456949484361764909828",
"266886193147361856258799168351555212040",
"214504442397693514167729413938022920837",
"229852729449954532100612245401706898462",
"100774011353643330765672170785908637995",
"265014323399239305191108005238727683524",
"195750133072954997824415972254424713277",
"272504666563509279854270445428959774698",
"134184429581707396153847292694777017050",
"16649782201415787779663685329076252331",
"127185530122079803589778200843716348651",
"237006680015935583086739881497485755387",
"27551470514277282219454823162008733325"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0954982db8283016bf38e9db2da5adf47a102e19",
"target": {
"file": "tools/testing/selftests/bpf/progs/verifier_raw_stack.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-e6605ebf",
"digest": {
"line_hashes": [
"186124587667494228159697133990179497852",
"191410742381785480280324944996812968991",
"125414820830368314594531591153852362460",
"41053797361917770830148938377169152873",
"322375372310322715022336274473426115197",
"325061003881594579021412441338587538592"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fbcf372c8eda2290470268e0afb5ab5d5f5d5fde",
"target": {
"file": "tools/testing/selftests/bpf/progs/iters.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-eb7c2bc2",
"digest": {
"line_hashes": [
"298360986700104913255506594728488806271",
"70892012051506276420152150085600791443",
"155386542963053082291985150222874387629"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"file": "tools/testing/selftests/bpf/progs/verifier_basic_stack.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-f83ae3f2",
"digest": {
"line_hashes": [
"293992134898797694592795005806555116041",
"210965580631776955067227425659255089937",
"28758506422671640501434824571306504107",
"19258381469245271527062061791829499865",
"250752379342516936450410380596200930085",
"205579259442480066340366119033563618456",
"197179814324963802049178363551749800398",
"281266381754431448410786642833437400554",
"87277308427706994058369488460721964052",
"315033928939056696463663021993000775716"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6b4a64bafd107e521c01eec3453ce94a3fb38529",
"target": {
"function": "check_stack_slot_within_bounds",
"file": "kernel/bpf/verifier.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"id": "CVE-2023-52452-fac34913",
"digest": {
"function_hash": "135619869972277123169989516005584098425",
"length": 236.0
}
}
]