kernel: bpf: Skip invalid kfunc call in backtrack_insn

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip invalid kfunc call in backtrackinsn The verifier skips invalid kfunc call in checkkfunccall, which would be captured in fixupkfunccall if such insn is not eliminated by dead code elimination. However, this can lead to t...

kernel: bpf, verifier: Fix memory leak in array reallocation for stack state

A flaw was found in the eBPF subsystem in the Linux kernel. An incorrect logic in a helper function for memory reallocation can cause memory leaks when a memory allocation error occurs, potentially leading to system instability and a denial of service...

kernel: bpf: Fix reference state management for synchronous callbacks

A flaw was found in the Linux kernel's BPF verifier. The verifier incorrectly handles reference state management for synchronous callbacks that execute multiple times foreach style helpers. This can lead to reference leaks when callbacks acquire references, or double-free conditions when callback...

kernel: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation

A vulnerability was found in the Linux kernel's eBPF verifier function checkstackwrite, where pointer leakage can occur due to insufficient speculative store bypass mitigation. This issue occurs because the original mitigation inserts lfence instructions after initializing a stack slot and spilli...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: tekton-chains, ctop, aactl, kpt, falcoctl-fips, scorecard, chartmuseum, spire-server-fips, kubescape, bom, k3d, paranoia, skaffold, up, k3s, slsa-verifier...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: up, scorecard, prometheus-adapter-fips, k3d, buildkitd, metrics-server-fips, prometheus-stackdriver-exporter, prometheus-blackbox-exporter, dynamic-localpv-provisioner-fips, falcoctl-fips, kubeflow, plutono-fips, timestamp-authority-fips, dgraph,...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: kubevela, scorecard, cortex, dgraph, buildkitd, src, kubeflow, kubescape, slsa-verifier, up, terraform-provider-sendgrid, spark-operator, k3d, aactl...

GO-2023-2119 Proof forgery due to insufficient randomness in github.com/consensys/gnark

A a third party may derive a valid proof from a valid initial tuple proof, publicinputs, corresponding to the same public inputs as the initial proof. This vulnerability is due to randomness being generated using a small part of the scratch memory describing the state, allowing for degrees of...

GHSA-7P92-X423-VWJ6 Plonk verifier KZG multi point verification

Impact The vulnerability allows a third party to derive a valid proof from a valid initial tuple proof, publicinputs, corresponding to the same public inputs as the initial proof. It is due to a randomness being generated using a small part of the scratch memory describing the state, allowing for...

Plonk verifier KZG multi point verification

Impact The vulnerability allows a third party to derive a valid proof from a valid initial tuple proof, publicinputs, corresponding to the same public inputs as the initial proof. It is due to a randomness being generated using a small part of the scratch memory describing the state, allowing for...

GHSA-4374-P667-P6C8 vulnerabilities

Vulnerabilities for packages: prometheus-alertmanager, gke-gcloud-auth-plugin, kubernetes-ingress-defaultbackend, prometheus-pushgateway, prometheus-postgres-exporter, gobuster, prometheus-mongodb-exporter-fips, kubeflow-katib, prometheus-adapter, aws-load-balancer-controller,...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: newrelic-infrastructure-agent, pulumi-language-yaml, flux-kustomize-controller, kubevela, scorecard, gke-gcloud-auth-plugin, grype, metacontroller, src, flux-source-controller, nginx-stable, slsa-verifier, ollama, oauth2-proxy, frp, ip-masq-agent, terraform, cue,...

USN-6397-1: Linux kernel (BlueField) vulnerabilities

Daniel Moghimi discovered that some IntelR Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. CVE-2022-40982 Ruihan Li discovered that the bluetooth subsystem ...

USN-6397-1 linux-bluefield vulnerabilities

Daniel Moghimi discovered that some IntelR Processors did not properly clear microarchitectural state after speculative execution of various instructions. A local unprivileged user could use this to obtain to sensitive information. CVE-2022-40982 Ruihan Li discovered that the bluetooth subsystem ...

Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation

...

CVE-2023-2163

Incorrect verifier pruning in BPF in Linux Kernel =5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape...

AZL-29941 CVE-2023-2163 affecting package kernel for versions less than 5.15.133.1-1

Incorrect verifier pruning in BPF in Linux Kernel =5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape...

Privilege escalation

Incorrect verifier pruning in BPF in Linux Kernel =5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape...

CVE-2023-2163

Summary of CVE-2023-2163 : The issue is an incorrect verifier pruning in the kernel’s BPF verifier for Linux kernel versions >= 5.4, where unsafe code paths can be marked safe, enabling arbitrary reads/writes in kernel memory, lateral privilege escalation, and container escapes. Connected advi...

CVE-2023-2163 Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation

Incorrect verifier pruning in BPF in Linux Kernel =5.4 leads to unsafe code paths being incorrectly marked as safe, resulting in arbitrary read/write in kernel memory, lateral privilege escalation, and container escape...