CVE-2023-52928
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2023-52928
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-52928.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2023-52928
- Downstream
- Published
- 2025-03-27T16:37:10Z
- Modified
- 2025-10-21T15:19:46.034975Z
- Summary
- bpf: Skip invalid kfunc call in backtrack_insn
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
bpf: Skip invalid kfunc call in backtrack_insn
The verifier skips invalid kfunc call in checkkfunccall(), which would be captured in fixupkfunccall() if such insn is not eliminated by dead code elimination. However, this can lead to the following warning in backtrack_insn(), also see [1]:
------------[ cut here ]------------ verifier backtracking bug WARNING: CPU: 6 PID: 8646 at kernel/bpf/verifier.c:2756 backtrackinsn kernel/bpf/verifier.c:2756 _markchainprecision kernel/bpf/verifier.c:3065 markchainprecision kernel/bpf/verifier.c:3165 adjustregminmaxvals kernel/bpf/verifier.c:10715 checkaluop kernel/bpf/verifier.c:10928 docheck kernel/bpf/verifier.c:13821 [inline] docheck_common kernel/bpf/verifier.c:16289 [...]
So make backtracking conservative with this by returning ENOTSUPP.
[1] https://lore.kernel.org/bpf/CACkBjsaXNceR8ZjkLG=dT3P=4A8SBsg0Z5h5PWLryF5=ghKq=g@mail.gmail.com/
- References
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede6ac2450d6dee3121cd8bbf2907b78a68a8a353dFixed6e2fac197de2c4c041bdd8982cffb104689113f1
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede6ac2450d6dee3121cd8bbf2907b78a68a8a353dFixed74eec8266f37aff609db6a2f2b093e56a11c28c4
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introducede6ac2450d6dee3121cd8bbf2907b78a68a8a353dFixedd3178e8a434b58678d99257c0387810a24042fb6
Affected versions
v5.*
v5.12
v5.12-rc5
v5.12-rc6
v5.12-rc7
v5.12-rc8
v5.13
v5.13-rc1
v5.13-rc2
v5.13-rc3
v5.13-rc4
v5.13-rc5
v5.13-rc6
v5.13-rc7
v5.14
v5.14-rc1
v5.14-rc2
v5.14-rc3
v5.14-rc4
v5.14-rc5
v5.14-rc6
v5.14-rc7
v5.15
v5.15-rc1
v5.15-rc2
v5.15-rc3
v5.15-rc4
v5.15-rc5
v5.15-rc6
v5.15-rc7
v5.15.1
v5.15.10
v5.15.11
v5.15.12
v5.15.13
v5.15.14
v5.15.15
v5.15.16
v5.15.17
v5.15.18
v5.15.19
v5.15.2
v5.15.20
v5.15.21
v5.15.22
v5.15.23
v5.15.24
v5.15.25
v5.15.26
v5.15.27
v5.15.28
v5.15.29
v5.15.3
v5.15.30
v5.15.31
v5.15.32
v5.15.33
v5.15.34
v5.15.35
v5.15.36
v5.15.37
v5.15.38
v5.15.39
v5.15.4
v5.15.40
v5.15.41
v5.15.42
v5.15.43
v5.15.44
v5.15.45
v5.15.46
v5.15.47
v5.15.48
v5.15.49
v5.15.5
v5.15.50
v5.15.51
v5.15.52
v5.15.53
v5.15.54
v5.15.55
v5.15.56
v5.15.57
v5.15.58
v5.15.59
v5.15.6
v5.15.60
v5.15.61
v5.15.62
v5.15.63
v5.15.64
v5.15.65
v5.15.66
v5.15.67
v5.15.68
v5.15.69
v5.15.7
v5.15.70
v5.15.71
v5.15.72
v5.15.73
v5.15.74
v5.15.75
v5.15.76
v5.15.77
v5.15.78
v5.15.79
v5.15.8
v5.15.80
v5.15.81
v5.15.82
v5.15.83
v5.15.84
v5.15.85
v5.15.86
v5.15.87
v5.15.88
v5.15.89
v5.15.9
v5.15.90
v5.15.91
v5.15.92
v5.16
v5.16-rc1
v5.16-rc2
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.17
v5.17-rc1
v5.17-rc2
v5.17-rc3
v5.17-rc4
v5.17-rc5
v5.17-rc6
v5.17-rc7
v5.17-rc8
v5.18
v5.18-rc1
v5.18-rc2
v5.18-rc3
v5.18-rc4
v5.18-rc5
v5.18-rc6
v5.18-rc7
v5.19
v5.19-rc1
v5.19-rc2
v5.19-rc3
v5.19-rc4
v5.19-rc5
v5.19-rc6
v5.19-rc7
v5.19-rc8
v6.*
v6.0
v6.0-rc1
v6.0-rc2
v6.0-rc3
v6.0-rc4
v6.0-rc5
v6.0-rc6
v6.0-rc7
v6.1
v6.1-rc1
v6.1-rc2
v6.1-rc3
v6.1-rc4
v6.1-rc5
v6.1-rc6
v6.1-rc7
v6.1-rc8
v6.1.1
v6.1.10
v6.1.2
v6.1.3
v6.1.4
v6.1.5
v6.1.6
v6.1.7
v6.1.8
v6.1.9
v6.2-rc1
v6.2-rc2
Database specific
vanir_signatures
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e2fac197de2c4c041bdd8982cffb104689113f1",
"id": "CVE-2023-52928-0d4f4824",
"deprecated": false,
"target": {
"file": "kernel/bpf/verifier.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"152491012989565017941604864868971290723",
"133399432083863455696819569940961281217",
"218366233937849315118037523552953963654",
"30770698244578540965188514255531968740"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74eec8266f37aff609db6a2f2b093e56a11c28c4",
"id": "CVE-2023-52928-18c80685",
"deprecated": false,
"target": {
"function": "backtrack_insn",
"file": "kernel/bpf/verifier.c"
},
"signature_version": "v1",
"digest": {
"length": 2271.0,
"function_hash": "296922791776610533682969615771430477812"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6e2fac197de2c4c041bdd8982cffb104689113f1",
"id": "CVE-2023-52928-192edca8",
"deprecated": false,
"target": {
"function": "backtrack_insn",
"file": "kernel/bpf/verifier.c"
},
"signature_version": "v1",
"digest": {
"length": 2270.0,
"function_hash": "21569282185065055732533986931370278431"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3178e8a434b58678d99257c0387810a24042fb6",
"id": "CVE-2023-52928-94596eaa",
"deprecated": false,
"target": {
"file": "kernel/bpf/verifier.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"71253863025640975553198147248093018095",
"36468923134076397497421742548815887569",
"226757328573800634496649982373400144922",
"30770698244578540965188514255531968740"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@74eec8266f37aff609db6a2f2b093e56a11c28c4",
"id": "CVE-2023-52928-bf6008e9",
"deprecated": false,
"target": {
"file": "kernel/bpf/verifier.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"152491012989565017941604864868971290723",
"133399432083863455696819569940961281217",
"218366233937849315118037523552953963654",
"30770698244578540965188514255531968740"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d3178e8a434b58678d99257c0387810a24042fb6",
"id": "CVE-2023-52928-de5f515b",
"deprecated": false,
"target": {
"function": "backtrack_insn",
"file": "kernel/bpf/verifier.c"
},
"signature_version": "v1",
"digest": {
"length": 2345.0,
"function_hash": "115177993689360487631200632679906163354"
},
"signature_type": "Function"
}
]