CVE-2023-52447: Linux Kernel Use-After-Free Vulnerability

CVE-2023-52447 Overview

CVE-2023-52447 is a use-after-free vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. The flaw exists in the handling of inner maps within map arrays and map hash tables. When updating or deleting an inner map, the map may still be accessed by both non-sleepable and sleepable BPF programs. The bpf_map_fd_put_ptr() function decreases the reference counter of the inner map directly through bpf_map_put(), and when this is the last reference (which is the common case), the inner map is freed via ops->map_free() in a kworker. However, most .map_free() callbacks do not use synchronize_rcu() or its variants to wait for the elapse of an RCU grace period, leading to potential use-after-free conditions when BPF programs continue accessing the freed inner map.

Critical Impact
Local attackers with high privileges can exploit this use-after-free vulnerability to potentially achieve confidentiality, integrity, and availability impacts on affected Linux kernel systems through malicious BPF map operations.

Affected Products

Linux Kernel (multiple versions)
Debian Linux (see Debian LTS Security Announcement)
Systems running vulnerable kernel versions with BPF subsystem enabled

Discovery Timeline

February 22, 2024 - CVE-2023-52447 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-52447

Vulnerability Analysis

This vulnerability stems from a race condition in the Linux kernel's BPF map handling mechanism, specifically affecting the lifecycle management of inner maps within nested map structures. The BPF subsystem supports maps of maps (map arrays and map hash tables), where an outer map contains references to inner maps. When an inner map is removed from an outer map through update or delete operations, the kernel must ensure that no BPF programs are still accessing the inner map before freeing it.

The core issue lies in the bpf_map_fd_put_ptr() function's direct invocation of bpf_map_put() to decrement the inner map's reference counter. When the reference count reaches zero, the map is scheduled for deallocation via ops->map_free() in a kernel worker thread. The problem is that most map type implementations do not implement proper RCU (Read-Copy-Update) synchronization in their .map_free() callbacks, failing to wait for all potential readers to complete their access before freeing the memory.

BPF programs run in RCU read-side critical sections and may hold references to inner maps during execution. Without proper RCU grace period waiting, the memory backing an inner map can be freed while a BPF program is still accessing it, resulting in a classic use-after-free condition. This can lead to memory corruption, information disclosure, or potentially arbitrary code execution within kernel context.

Root Cause

The root cause is the lack of proper RCU synchronization when freeing inner maps that have been removed from outer maps. The .map_free() callbacks for most BPF map types do not call synchronize_rcu() or synchronize_rcu_tasks_trace() to ensure that all RCU readers (including both non-sleepable and sleepable BPF programs) have completed their access to the map before the memory is freed.

Attack Vector

The attack requires local access to the system with privileges sufficient to create and manipulate BPF maps and programs (typically requiring CAP_BPF or CAP_SYS_ADMIN capabilities). An attacker would need to:

Create nested BPF map structures (outer map containing inner maps)
Load BPF programs that access inner maps
Trigger inner map updates or deletions while BPF programs are accessing the maps
Race the BPF program access against the map deallocation to trigger use-after-free

The fix implements deferred freeing by invoking bpf_map_free_deferred() after both one RCU grace period and one tasks trace RCU grace period when the inner map has been removed from the outer map. This is accomplished using call_rcu() or call_rcu_tasks_trace() when releasing the last reference counter. The implementation optimizes memory usage by having the newly-added rcu_head field in bpf_map share storage space with the work field.

Detection Methods for CVE-2023-52447

Indicators of Compromise

Kernel crash logs or oops messages referencing BPF map operations or RCU-related functions
Unexpected system instability when running BPF programs with nested map structures
Memory corruption indicators in kernel logs related to BPF subsystem
Audit logs showing suspicious BPF syscalls from unprivileged processes

Detection Strategies

Monitor for kernel panic events with call traces involving bpf_map_put, bpf_map_free_deferred, or map hash table functions
Implement kernel auditing for BPF syscalls, particularly BPF_MAP_UPDATE_ELEM and BPF_MAP_DELETE_ELEM operations on maps of maps
Deploy runtime kernel integrity monitoring to detect memory corruption patterns
Use kernel memory sanitizers (KASAN) in development/testing environments to detect use-after-free conditions

Monitoring Recommendations

Enable kernel tracing for BPF subsystem events using ftrace or perf
Configure audit rules to log BPF-related syscalls with elevated privileges
Monitor system logs for RCU stall warnings or BPF-related error messages
Implement host-based intrusion detection to identify unusual BPF program loading patterns

How to Mitigate CVE-2023-52447

Immediate Actions Required

Update the Linux kernel to a patched version containing the fix
Review and restrict BPF capability grants (CAP_BPF, CAP_SYS_ADMIN) to only essential processes
Consider disabling unprivileged BPF if not required (kernel.unprivileged_bpf_disabled=1)
Apply distribution-specific security patches from your Linux vendor

Patch Information

The fix has been applied to the stable Linux kernel branches. The patch implements deferred inner map freeing using RCU callbacks to ensure proper synchronization. The following kernel commits contain the fix:

Debian users should refer to the Debian LTS Security Announcement for distribution-specific patching guidance.

Workarounds

Restrict BPF capabilities to only trusted users and processes using capability bounding sets
Disable unprivileged BPF access system-wide by setting kernel.unprivileged_bpf_disabled=1
Limit access to the bpf() syscall using seccomp filters for untrusted workloads
Consider using SELinux or AppArmor policies to restrict BPF operations

bash

# Disable unprivileged BPF access
echo 1 > /proc/sys/kernel/unprivileged_bpf_disabled

# Make persistent across reboots (add to /etc/sysctl.conf or /etc/sysctl.d/)
echo "kernel.unprivileged_bpf_disabled=1" >> /etc/sysctl.d/99-bpf-hardening.conf
sysctl -p /etc/sysctl.d/99-bpf-hardening.conf