In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix memleak due to fentry attach failure
If it fails to attach fentry, the allocated bpf trampoline image will be left in the system. That can be verified by checking /proc/kallsyms.
This meamleak can be verified by a simple bpf program as follows:
SEC("fentry/trapinit") int fentryrun() { return 0; }
It will fail to attach trap_init because this function is freed after kernel init, and then we can find the trampoline image is left in the system by checking /proc/kallsyms.
$ tail /proc/kallsyms ffffffffc0613000 t bpftrampoline64424534661 [bpf] ffffffffc06c3000 t bpftrampoline64424534661 [bpf]
$ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trapinit'" [2522] FUNC 'trapinit' type_id=119 linkage=static
$ echo $((6442453466 & 0x7fffffff)) 2522
Note that there are two left bpf trampoline images, that is because the libbpf will fallback to raw tracepoint if -EINVAL is returned.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/53xxx/CVE-2023-53221.json"
}[
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@108598c39eefbedc9882273ac0df96127a629220",
"digest": {
"threshold": 0.9,
"line_hashes": [
"323721210855531077070736912834344882094",
"235758968998238337374445669976286475180",
"11873210972521277084434208602907396667",
"265740108422257175838248098841676044918",
"104337309513019508622683306206817514955",
"2516766277655035762188460352729021710",
"96161489140413512205639568074603715966",
"272246019010453395416015496455135068029",
"251137431380205885938414822033159786227",
"190695344149744730218556952429040141808",
"309208172403696049919620210192569324437",
"253576213788242112675510606605423244395",
"339013424556690515417045513950914330133",
"337930479370851533252434031188996097630",
"226483013748793112630938090338577919621",
"317347454306931957447012775382860774251",
"308274293865168392347470558448703214992",
"133419110856139066496628869960530538140",
"69801078144583431515190058867542408555",
"274458389849615428876941218421400864230",
"115962669677613664981593270608982048822",
"148894050208701634357946489713968050523"
]
},
"target": {
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2023-53221-0b0ed7e3",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20109ddd5bea2c24d790debf5d02584ef24c3f5e",
"digest": {
"function_hash": "287843995324877707170699156845181374476",
"length": 241.0
},
"target": {
"file": "kernel/bpf/trampoline.c",
"function": "__bpf_tramp_image_put_deferred"
},
"id": "CVE-2023-53221-0f4065af",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f72c67d1a82dada7d6d504c806e111e913721a30",
"digest": {
"threshold": 0.9,
"line_hashes": [
"323721210855531077070736912834344882094",
"235758968998238337374445669976286475180",
"11873210972521277084434208602907396667",
"265740108422257175838248098841676044918",
"104337309513019508622683306206817514955",
"2516766277655035762188460352729021710",
"96161489140413512205639568074603715966",
"272246019010453395416015496455135068029",
"251137431380205885938414822033159786227",
"190695344149744730218556952429040141808",
"309208172403696049919620210192569324437",
"253576213788242112675510606605423244395",
"339013424556690515417045513950914330133",
"337930479370851533252434031188996097630",
"226483013748793112630938090338577919621",
"317347454306931957447012775382860774251",
"308274293865168392347470558448703214992",
"133419110856139066496628869960530538140",
"69801078144583431515190058867542408555",
"274458389849615428876941218421400864230",
"115962669677613664981593270608982048822",
"148894050208701634357946489713968050523"
]
},
"target": {
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2023-53221-31544e2b",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f72c67d1a82dada7d6d504c806e111e913721a30",
"digest": {
"function_hash": "287843995324877707170699156845181374476",
"length": 241.0
},
"target": {
"file": "kernel/bpf/trampoline.c",
"function": "__bpf_tramp_image_put_deferred"
},
"id": "CVE-2023-53221-5590b79d",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20109ddd5bea2c24d790debf5d02584ef24c3f5e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"323721210855531077070736912834344882094",
"235758968998238337374445669976286475180",
"11873210972521277084434208602907396667",
"265740108422257175838248098841676044918",
"104337309513019508622683306206817514955",
"2516766277655035762188460352729021710",
"96161489140413512205639568074603715966",
"272246019010453395416015496455135068029",
"251137431380205885938414822033159786227",
"190695344149744730218556952429040141808",
"309208172403696049919620210192569324437",
"319335233364812776791447019724279920939",
"123880688463171129253239133456671359750",
"125051962017271690050177729998065762450",
"226483013748793112630938090338577919621",
"317347454306931957447012775382860774251",
"308274293865168392347470558448703214992",
"133419110856139066496628869960530538140",
"69801078144583431515190058867542408555",
"274458389849615428876941218421400864230",
"115962669677613664981593270608982048822",
"148894050208701634357946489713968050523"
]
},
"target": {
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2023-53221-5f7c38c4",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6aa27775db63ba8c7c73891c7dfb71ddc230c48d",
"digest": {
"function_hash": "195118206850214567852613981536787701374",
"length": 1843.0
},
"target": {
"file": "kernel/bpf/trampoline.c",
"function": "bpf_trampoline_update"
},
"id": "CVE-2023-53221-7548abbd",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@108598c39eefbedc9882273ac0df96127a629220",
"digest": {
"function_hash": "195118206850214567852613981536787701374",
"length": 1843.0
},
"target": {
"file": "kernel/bpf/trampoline.c",
"function": "bpf_trampoline_update"
},
"id": "CVE-2023-53221-7d70e88a",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@108598c39eefbedc9882273ac0df96127a629220",
"digest": {
"function_hash": "287843995324877707170699156845181374476",
"length": 241.0
},
"target": {
"file": "kernel/bpf/trampoline.c",
"function": "__bpf_tramp_image_put_deferred"
},
"id": "CVE-2023-53221-b0eff343",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6aa27775db63ba8c7c73891c7dfb71ddc230c48d",
"digest": {
"function_hash": "287843995324877707170699156845181374476",
"length": 241.0
},
"target": {
"file": "kernel/bpf/trampoline.c",
"function": "__bpf_tramp_image_put_deferred"
},
"id": "CVE-2023-53221-bbf6364b",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f72c67d1a82dada7d6d504c806e111e913721a30",
"digest": {
"function_hash": "195118206850214567852613981536787701374",
"length": 1843.0
},
"target": {
"file": "kernel/bpf/trampoline.c",
"function": "bpf_trampoline_update"
},
"id": "CVE-2023-53221-c368adb3",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@20109ddd5bea2c24d790debf5d02584ef24c3f5e",
"digest": {
"function_hash": "340195369243049578693336481469618042299",
"length": 1885.0
},
"target": {
"file": "kernel/bpf/trampoline.c",
"function": "bpf_trampoline_update"
},
"id": "CVE-2023-53221-f56713a1",
"deprecated": false,
"signature_version": "v1"
},
{
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6aa27775db63ba8c7c73891c7dfb71ddc230c48d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"323721210855531077070736912834344882094",
"235758968998238337374445669976286475180",
"11873210972521277084434208602907396667",
"265740108422257175838248098841676044918",
"104337309513019508622683306206817514955",
"2516766277655035762188460352729021710",
"96161489140413512205639568074603715966",
"272246019010453395416015496455135068029",
"251137431380205885938414822033159786227",
"190695344149744730218556952429040141808",
"309208172403696049919620210192569324437",
"253576213788242112675510606605423244395",
"339013424556690515417045513950914330133",
"337930479370851533252434031188996097630",
"226483013748793112630938090338577919621",
"317347454306931957447012775382860774251",
"308274293865168392347470558448703214992",
"133419110856139066496628869960530538140",
"69801078144583431515190058867542408555",
"274458389849615428876941218421400864230",
"115962669677613664981593270608982048822",
"148894050208701634357946489713968050523"
]
},
"target": {
"file": "kernel/bpf/trampoline.c"
},
"id": "CVE-2023-53221-fd196024",
"deprecated": false,
"signature_version": "v1"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-53221.json"