Junglewise Threat Intelligence

CVE-2023-52447: Linux kernel use-after-free in BPF inner map handling

CVE-2023-52447 · Severity: medium · CVSS 6.7 · Published 2024-02-22

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, which is used for high-performance networking and system monitoring. Under certain conditions, when internal data structures (maps) are updated or deleted, the system may prematurely free memory that is still being used by active programs. This can lead to a system crash or allow an attacker with high privileges to compromise the integrity of the operating system.

Technical details

A use-after-free (UAF) vulnerability exists in the Linux kernel BPF subsystem due to improper synchronization when freeing inner maps. When an inner map in a map-in-map structure (array or hash table) is updated or deleted, `bpf_map_fd_put_ptr()` immediately decrements the reference counter. If this is the last reference, the map is freed via a kworker without waiting for an RCU grace period. However, sleepable or non-sleepable BPF programs may still be accessing the map. The fix involves deferring the free operation using `call_rcu()` and `call_rcu_tasks_trace()` to ensure all RCU grace periods have elapsed before the memory is reclaimed. This issue affects kernels that allow map-in-map usage in sleepable programs.

Affected products

  • Linux Linux kernel 5.9.0 to 6.1.75, 6.2.0 to 6.6.14, 6.7.0 to 6.7.2

Timeline

  • 2023-12-04: disclosed: Initial patch submitted to Linux kernel mailing lists
  • 2024-01-25: patched: Patch committed to stable kernel branches
  • 2024-02-22: advisory: CVE-2023-52447 published

References

Related threats