CVE-2023-53634

A control-flow integrity flaw was found in the Linux kernel on the arm64 architecture within the extended Berkeley Packet Filter trampoline return path. Returning to a patched function with an instruction sequence that fails the branch-target security check can trigger an exception and panic.

A local user could use this flaw to crash the system when attaching programs that patch kernel call sites, resulting in a denial of service.

When the trampoline is configured to call the original function, it used an indirect branch back to the instruction after the call site. On arm64 systems with branch target enforcement, if that instruction is not one of the expected landing pads, the hardware raises an exception. The fix switches to a return instruction so the hardware recognizes a valid return target.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module bpf from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.