In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix memleak due to fentry attach failure
If it fails to attach fentry, the allocated bpf trampoline image will be left in the system. That can be verified by checking /proc/kallsyms.
This meamleak can be verified by a simple bpf program as follows:
SEC("fentry/trapinit") int fentryrun() { return 0; }
It will fail to attach trap_init because this function is freed after kernel init, and then we can find the trampoline image is left in the system by checking /proc/kallsyms.
$ tail /proc/kallsyms ffffffffc0613000 t bpftrampoline64424534661 [bpf] ffffffffc06c3000 t bpftrampoline64424534661 [bpf]
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trapinit'" [2522] FUNC 'trapinit' type_id=119 linkage=static
$ echo $((6442453466 & 0x7fffffff)) 2522
Note that there are two left bpf trampoline images, that is because the libbpf will fallback to raw tracepoint if -EINVAL is returned.
{ "vanir_signatures": [ { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@108598c39eefbedc9882273ac0df96127a629220", "deprecated": false, "id": "CVE-2023-53221-0b0ed7e3", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "323721210855531077070736912834344882094", "235758968998238337374445669976286475180", "11873210972521277084434208602907396667", "265740108422257175838248098841676044918", "104337309513019508622683306206817514955", "2516766277655035762188460352729021710", "96161489140413512205639568074603715966", "272246019010453395416015496455135068029", "251137431380205885938414822033159786227", "190695344149744730218556952429040141808", "309208172403696049919620210192569324437", "253576213788242112675510606605423244395", "339013424556690515417045513950914330133", "337930479370851533252434031188996097630", "226483013748793112630938090338577919621", "317347454306931957447012775382860774251", "308274293865168392347470558448703214992", "133419110856139066496628869960530538140", "69801078144583431515190058867542408555", "274458389849615428876941218421400864230", "115962669677613664981593270608982048822", "148894050208701634357946489713968050523" ] }, "target": { "file": "kernel/bpf/trampoline.c" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20109ddd5bea2c24d790debf5d02584ef24c3f5e", "deprecated": false, "id": "CVE-2023-53221-0f4065af", "signature_type": "Function", "digest": { "length": 241.0, "function_hash": "287843995324877707170699156845181374476" }, "target": { "file": "kernel/bpf/trampoline.c", "function": "__bpf_tramp_image_put_deferred" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f72c67d1a82dada7d6d504c806e111e913721a30", "deprecated": false, "id": "CVE-2023-53221-31544e2b", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "323721210855531077070736912834344882094", "235758968998238337374445669976286475180", "11873210972521277084434208602907396667", "265740108422257175838248098841676044918", "104337309513019508622683306206817514955", "2516766277655035762188460352729021710", "96161489140413512205639568074603715966", "272246019010453395416015496455135068029", "251137431380205885938414822033159786227", "190695344149744730218556952429040141808", "309208172403696049919620210192569324437", "253576213788242112675510606605423244395", "339013424556690515417045513950914330133", "337930479370851533252434031188996097630", "226483013748793112630938090338577919621", "317347454306931957447012775382860774251", "308274293865168392347470558448703214992", "133419110856139066496628869960530538140", "69801078144583431515190058867542408555", "274458389849615428876941218421400864230", "115962669677613664981593270608982048822", "148894050208701634357946489713968050523" ] }, "target": { "file": "kernel/bpf/trampoline.c" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f72c67d1a82dada7d6d504c806e111e913721a30", "deprecated": false, "id": "CVE-2023-53221-5590b79d", "signature_type": "Function", "digest": { "length": 241.0, "function_hash": "287843995324877707170699156845181374476" }, "target": { "file": "kernel/bpf/trampoline.c", "function": "__bpf_tramp_image_put_deferred" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20109ddd5bea2c24d790debf5d02584ef24c3f5e", "deprecated": false, "id": "CVE-2023-53221-5f7c38c4", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "323721210855531077070736912834344882094", "235758968998238337374445669976286475180", "11873210972521277084434208602907396667", "265740108422257175838248098841676044918", "104337309513019508622683306206817514955", "2516766277655035762188460352729021710", "96161489140413512205639568074603715966", "272246019010453395416015496455135068029", "251137431380205885938414822033159786227", "190695344149744730218556952429040141808", "309208172403696049919620210192569324437", "319335233364812776791447019724279920939", "123880688463171129253239133456671359750", "125051962017271690050177729998065762450", "226483013748793112630938090338577919621", "317347454306931957447012775382860774251", "308274293865168392347470558448703214992", "133419110856139066496628869960530538140", "69801078144583431515190058867542408555", "274458389849615428876941218421400864230", "115962669677613664981593270608982048822", "148894050208701634357946489713968050523" ] }, "target": { "file": "kernel/bpf/trampoline.c" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6aa27775db63ba8c7c73891c7dfb71ddc230c48d", "deprecated": false, "id": "CVE-2023-53221-7548abbd", "signature_type": "Function", "digest": { "length": 1843.0, "function_hash": "195118206850214567852613981536787701374" }, "target": { "file": "kernel/bpf/trampoline.c", "function": "bpf_trampoline_update" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@108598c39eefbedc9882273ac0df96127a629220", "deprecated": false, "id": "CVE-2023-53221-7d70e88a", "signature_type": "Function", "digest": { "length": 1843.0, "function_hash": "195118206850214567852613981536787701374" }, "target": { "file": "kernel/bpf/trampoline.c", "function": "bpf_trampoline_update" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@108598c39eefbedc9882273ac0df96127a629220", "deprecated": false, "id": "CVE-2023-53221-b0eff343", "signature_type": "Function", "digest": { "length": 241.0, "function_hash": "287843995324877707170699156845181374476" }, "target": { "file": "kernel/bpf/trampoline.c", "function": "__bpf_tramp_image_put_deferred" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6aa27775db63ba8c7c73891c7dfb71ddc230c48d", "deprecated": false, "id": "CVE-2023-53221-bbf6364b", "signature_type": "Function", "digest": { "length": 241.0, "function_hash": "287843995324877707170699156845181374476" }, "target": { "file": "kernel/bpf/trampoline.c", "function": "__bpf_tramp_image_put_deferred" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f72c67d1a82dada7d6d504c806e111e913721a30", "deprecated": false, "id": "CVE-2023-53221-c368adb3", "signature_type": "Function", "digest": { "length": 1843.0, "function_hash": "195118206850214567852613981536787701374" }, "target": { "file": "kernel/bpf/trampoline.c", "function": "bpf_trampoline_update" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20109ddd5bea2c24d790debf5d02584ef24c3f5e", "deprecated": false, "id": "CVE-2023-53221-f56713a1", "signature_type": "Function", "digest": { "length": 1885.0, "function_hash": "340195369243049578693336481469618042299" }, "target": { "file": "kernel/bpf/trampoline.c", "function": "bpf_trampoline_update" } }, { "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6aa27775db63ba8c7c73891c7dfb71ddc230c48d", "deprecated": false, "id": "CVE-2023-53221-fd196024", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "323721210855531077070736912834344882094", "235758968998238337374445669976286475180", "11873210972521277084434208602907396667", "265740108422257175838248098841676044918", "104337309513019508622683306206817514955", "2516766277655035762188460352729021710", "96161489140413512205639568074603715966", "272246019010453395416015496455135068029", "251137431380205885938414822033159786227", "190695344149744730218556952429040141808", "309208172403696049919620210192569324437", "253576213788242112675510606605423244395", "339013424556690515417045513950914330133", "337930479370851533252434031188996097630", "226483013748793112630938090338577919621", "317347454306931957447012775382860774251", "308274293865168392347470558448703214992", "133419110856139066496628869960530538140", "69801078144583431515190058867542408555", "274458389849615428876941218421400864230", "115962669677613664981593270608982048822", "148894050208701634357946489713968050523" ] }, "target": { "file": "kernel/bpf/trampoline.c" } } ] }