Executive brief
The Linux kernel's BPF (Berkeley Packet Filter) CPU map feature has a resource cleanup bug that causes incorrect handling of network packets (skbs) when the CPU map entry is freed. Under certain conditions (XDP redirect with skb-mode and stress testing), packets destined for cleanup are incorrectly processed as XDP frames, triggering kernel warnings and potential memory leaks. This affects systems using BPF-based packet processing for network acceleration or filtering.
Technical details
The vulnerability is a logic error in the __cpu_map_ring_cleanup() function within kernel/bpf/cpumap.c. The function is responsible for freeing remaining pointers in a ring buffer when a CPU map entry is destroyed, but it treats all queued items as XDP frames without checking whether they are actually network socket buffers (skbs) stored in skb-mode. When skbs are present and treated as XDP frames, the __xdp_return() function is called with invalid memory types, triggering kernel warnings. The fix differentiates between skbs and XDP frames using a bit-marker (__ptr_test_bit), and calls the appropriate cleanup function (kfree_skb for skbs, xdp_return_frame for XDP frames). The vulnerability requires network-accessible exposure to BPF programs (local or adjacent network) and no authentication bypass is involved.
Affected products
- Linux Linux kernel 6.5.0 and prior versions with BPF cpumap support
Timeline
- 2023-07-31: disclosed: Patch committed by Martin KaFai Lau
- 2023-07-31: patched: Fix merged into stable tree (commit 7c62b75cd1a792e14b037fa4f61f9b18914e7de1)
- 2023: advisory: CVE-2023-53660 assigned