{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2023-53024","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-03-27T16:40:15.753Z","datePublished":"2025-03-27T16:43:49.824Z","dateUpdated":"2026-05-23T15:27:44.578Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-23T15:27:44.578Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix pointer-leak due to insufficient speculative store bypass mitigation\n\nTo mitigate Spectre v4, 2039f26f3aca (\"bpf: Fix leakage due to\ninsufficient speculative store bypass mitigation\") inserts lfence\ninstructions after 1) initializing a stack slot and 2) spilling a\npointer to the stack.\n\nHowever, this does not cover cases where a stack slot is first\ninitialized with a pointer (subject to sanitization) but then\noverwritten with a scalar (not subject to sanitization because\nthe slot was already initialized). In this case, the second write\nmay be subject to speculative store bypass (SSB) creating a\nspeculative pointer-as-scalar type confusion. This allows the\nprogram to subsequently leak the numerical pointer value using,\nfor example, a branch-based cache side channel.\n\nTo fix this, also sanitize scalars if they write a stack slot\nthat previously contained a pointer. Assuming that pointer-spills\nare only generated by LLVM on register-pressure, the performance\nimpact on most real-world BPF programs should be small.\n\nThe following unprivileged BPF bytecode drafts a minimal exploit\nand the mitigation:\n\n  [...]\n  // r6 = 0 or 1 (skalar, unknown user input)\n  // r7 = accessible ptr for side channel\n  // r10 = frame pointer (fp), to be leaked\n  //\n  r9 = r10 # fp alias to encourage ssb\n  *(u64 *)(r9 - 8) = r10 // fp[-8] = ptr, to be leaked\n  // lfence added here because of pointer spill to stack.\n  //\n  // Ommitted: Dummy bpf_ringbuf_output() here to train alias predictor\n  // for no r9-r10 dependency.\n  //\n  *(u64 *)(r10 - 8) = r6 // fp[-8] = scalar, overwrites ptr\n  // 2039f26f3aca: no lfence added because stack slot was not STACK_INVALID,\n  // store may be subject to SSB\n  //\n  // fix: also add an lfence when the slot contained a ptr\n  //\n  r8 = *(u64 *)(r9 - 8)\n  // r8 = architecturally a scalar, speculatively a ptr\n  //\n  // leak ptr using branch-based cache side channel:\n  r8 &= 1 // choose bit to leak\n  if r8 == 0 goto SLOW // no mispredict\n  // architecturally dead code if input r6 is 0,\n  // only executes speculatively iff ptr bit is 1\n  r8 = *(u64 *)(r7 + 0) # encode bit in cache (0: slow, 1: fast)\nSLOW:\n  [...]\n\nAfter running this, the program can time the access to *(r7 + 0) to\ndetermine whether the chosen pointer bit was 0 or 1. Repeat this 64\ntimes to recover the whole address on amd64.\n\nIn summary, sanitization can only be skipped if one scalar is\noverwritten with another scalar. Scalar-confusion due to speculative\nstore bypass can not lead to invalid accesses because the pointer\nbounds deducted during verification are enforced using branchless\nlogic. See 979d63d50c0c (\"bpf: prevent out of bounds speculation on\npointer arithmetic\") for details.\n\nDo not make the mitigation depend on !env->allow_{uninit_stack,ptr_leaks}\nbecause speculative leaks are likely unexpected if these were enabled.\nFor example, leaking the address to a protected log file may be acceptable\nwhile disabling the mitigation might unintentionally leak the address\ninto the cached-state of a map that is accessible to unprivileged\nprocesses."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/bpf/verifier.c"],"versions":[{"version":"872968502114d68c21419cf7eb5ab97717e7b803","lessThan":"aae109414a57ab4164218f36e2e4a17f027fcaaa","status":"affected","versionType":"git"},{"version":"f5893af2704eb763eb982f01d573f5b19f06b623","lessThan":"81b3374944d201872cfcf82730a7860f8e7c31dd","status":"affected","versionType":"git"},{"version":"0e9280654aa482088ee6ef3deadef331f5ac5fb0","lessThan":"da75dec7c6617bddad418159ffebcb133f008262","status":"affected","versionType":"git"},{"version":"2039f26f3aca5b0e419b98f65dd36481337b86ee","lessThan":"01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528","status":"affected","versionType":"git"},{"version":"2039f26f3aca5b0e419b98f65dd36481337b86ee","lessThan":"b0c89ef025562161242a7c19b213bd6b272e93df","status":"affected","versionType":"git"},{"version":"2039f26f3aca5b0e419b98f65dd36481337b86ee","lessThan":"e4f4db47794c9f474b184ee1418f42e6a07412b6","status":"affected","versionType":"git"},{"version":"0b27bdf02c400684225ee5ee99970bcbf5082282","status":"affected","versionType":"git"},{"version":"4.19.207","lessThan":"4.19.272","status":"affected","versionType":"semver"},{"version":"5.4.146","lessThan":"5.4.231","status":"affected","versionType":"semver"},{"version":"5.10.56","lessThan":"5.10.166","status":"affected","versionType":"semver"},{"version":"5.13.8","lessThan":"5.14","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/bpf/verifier.c"],"versions":[{"version":"5.14","status":"affected"},{"version":"0","lessThan":"5.14","status":"unaffected","versionType":"semver"},{"version":"4.19.272","lessThanOrEqual":"4.19.*","status":"unaffected","versionType":"semver"},{"version":"5.4.231","lessThanOrEqual":"5.4.*","status":"unaffected","versionType":"semver"},{"version":"5.10.166","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.91","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.9","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.207","versionEndExcluding":"4.19.272"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.146","versionEndExcluding":"5.4.231"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.56","versionEndExcluding":"5.10.166"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"5.15.91"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.1.9"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14","versionEndExcluding":"6.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13.8"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/aae109414a57ab4164218f36e2e4a17f027fcaaa"},{"url":"https://git.kernel.org/stable/c/81b3374944d201872cfcf82730a7860f8e7c31dd"},{"url":"https://git.kernel.org/stable/c/da75dec7c6617bddad418159ffebcb133f008262"},{"url":"https://git.kernel.org/stable/c/01bdcc73dbe7be3ad4d4ee9a59b71e42f461a528"},{"url":"https://git.kernel.org/stable/c/b0c89ef025562161242a7c19b213bd6b272e93df"},{"url":"https://git.kernel.org/stable/c/e4f4db47794c9f474b184ee1418f42e6a07412b6"}],"title":"bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation","x_generator":{"engine":"bippy-1.2.0"}}}}