CVE-2023-53645

A memory-safety flaw was found in the Linux kernel extended Berkeley Packet Filter (eBPF) subsystem in the way reference counts are acquired for objects after a failed tree insertion. When a program attempts to acquire a reference to a node that may already have been released, the reference count operation can proceed on a zero count, leading to a use-after-free and a crash. A local user could use this flaw to crash the system, resulting in a denial of service.

The change makes bpf_refcount_acquire return a nullable result and uses a “increment if not zero” primitive so that acquiring a reference on an object that may have been released fails safely. Verifier bookkeeping distinguishes owning from non-owning references so that callers with ownership still receive a guaranteed non-null result. This prevents reference count additions on an object whose lifetime ended after a failed container insertion.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent module bpf from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.