CVE-2023-53645

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory-safety flaw exists in the extended Berkeley Packet Filter (eBPF) subsystem regarding how reference counts are acquired for objects after a failed tree insertion. The issue stems from an incorrect assumption that a BPF program calling bpf refcount acquire() on a node can always guarantee the node is alive. In scenarios involving non-owning references, such as after bpf rbtree add() fails and calls bpf obj drop(), the program no longer owns the node's lifetime. This allows the node's reference count to be decreased to zero, potentially leading to a use-after-free condition if bpf refcount acquire() increments a zero refcount. A local user could exploit this to cause a system crash, resulting in a denial of service. The flaw is specifically linked to the bpf refcount acquire impl() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.