CVE-2023-52462

A flaw was found in the Linux kernel. When the register is spilled onto a stack as a 1/2/4-byte register, the slot_type[BPF_REG_SIZE - 1]  is set, possibly including a few more below it, depending on the actual spill size. To confirm if some stack slots have a spilled register, consult slot_type[7], not slot_type[0]. To avoid the need to remember and double-check this in the future, use the is_spilled_reg() helper.

This vulnerability is rated as Low severity because exploiting the BPF verifier flaw requires local execution privileges and, in default Red Hat Enterprise Linux environments, elevated administrative capabilities. Red Hat Enterprise Linux disables unprivileged eBPF by default, meaning an attacker must already possess CAP_BPF or CAP_SYS_ADMIN rights to load arbitrary BPF programs. Consequently, the blast radius is constrained to environments where untrusted users have already obtained high-level administrative capabilities, preventing unauthorized privilege escalation by ordinary local users.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Ensure unprivileged eBPF usage is disabled via the sysctl parameter.

To disable unprivileged eBPF immediately:

sysctl -w kernel.unprivileged_bpf_disabled=1

To ensure this configuration persists across system restarts, add the setting to a sysctl configuration file:

echo 'kernel.unprivileged_bpf_disabled = 1' > /etc/sysctl.d/99-bpf-disable.conf

Caveats: While this sysctl is enabled by default on standard Red Hat Enterprise Linux installations, it restricts program loading to privileged users with CAP_BPF or CAP_SYS_ADMIN. It does not mitigate exploitation by users or processes that already possess these elevated capabilities.