{"id":"CVE-2023-52452","revision":null,"records":[{"revision":"0cbf5858338244c38d9af64345c1f5cb","observedAt":"2026-10-30T13:45:33.454+00:00","statement":{"source":"cve-program","id":"CVE-2023-52452","aliases":[],"title":"bpf: Fix accesses to uninit stack slots","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix accesses to uninit stack slots\n\nPrivileged programs are supposed to be able to read uninitialized stack\nmemory (ever since 6715df8d5) but, before this patch, these accesses\nwere permitted inconsistently. In particular, accesses were permitted\nabove state->allocated_stack, but not below it. In other words, if the\nstack was already \"large enough\", the access was permitted, but\notherwise the access was rejected instead of being allowed to \"grow the\nstack\". This undesired rejection was happening in two places:\n- in check_stack_slot_within_bounds()\n- in check_stack_range_initialized()\nThis patch arranges for these accesses to be permitted. A bunch of tests\nthat were relying on the old rejection had to change; all of them were\nchanged to add also run unprivileged, in which case the old behavior\npersists. One tests couldn't be updated - global_func16 - because it\ncan't run unprivileged for other reasons.\n\nThis patch also fixes the tracking of the stack size for variable-offset\nreads. This second fix is bundled in the same commit as the first one\nbecause they're inter-related. Before this patch, writes to the stack\nusing registers containing a variable offset (as opposed to registers\nwith fixed, known values) were not properly contributing to the\nfunction's needed stack size. As a result, it was possible for a program\nto verify, but then to attempt to read out-of-bounds data at runtime\nbecause a too small stack had been allocated for it.\n\nEach function tracks the size of the stack it needs in\nbpf_subprog_info.stack_depth, which is maintained by\nupdate_stack_depth(). For regular memory accesses, check_mem_access()\nwas calling update_state_depth() but it was passing in only the fixed\npart of the offset register, ignoring the variable offset. This was\nincorrect; the minimum possible value of that register should be used\ninstead.\n\nThis tracking is now fixed by centralizing the tracking of stack size in\ngrow_stack_state(), and by lifting the calls to grow_stack_state() to\ncheck_stack_access_within_bounds() as suggested by Andrii. The code is\nnow simpler and more convincingly tracks the correct maximum stack size.\ncheck_stack_range_initialized() can now rely on enough stack having been\nallocated for the access; this helps with the fix for the first issue.\n\nA few tests were changed to also check the stack depth computation. The\none that fails without this patch is verifier_var_off:stack_write_priv_vs_unpriv.","state":0,"publishedAt":"2024-02-22T16:21:43.094+00:00","modifiedAt":"2026-10-30T12:17:11.466+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/verifier.c\",\n                        \"tools/testing/selftests/bpf/progs/iters.c\",\n                        \"tools/testing/selftests/bpf/progs/test_global_func16.c\",\n                        \"tools/testing/selftests/bpf/progs/verifier_basic_stack.c\",\n                        \"tools/testing/selftests/bpf/progs/verifier_int_ptr.c\",\n                        \"tools/testing/selftests/bpf/progs/verifier_raw_stack.c\",\n                        \"tools/testing/selftests/bpf/progs/verifier_var_off.c\",\n                        \"tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c\",\n                        \"tools/testing/selftests/bpf/verifier/calls.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"01f810ace9ed37255f27608a0864abebccf0aab3\",\n                            \"lessThan\": \"bf32eaf5093dc1c24ccc26b14c3422f6dfcc5236\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"01f810ace9ed37255f27608a0864abebccf0aab3\",\n                            \"lessThan\": \"0954982db8283016bf38e9db2da5adf47a102e19\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"01f810ace9ed37255f27608a0864abebccf0aab3\",\n                            \"lessThan\": \"fbcf372c8eda2290470268e0afb5ab5d5f5d5fde\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"01f810ace9ed37255f27608a0864abebccf0aab3\",\n                            \"lessThan\": \"6b4a64bafd107e521c01eec3453ce94a3fb38529\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f3c4b01689d392373301e6e60d1b02c5b4020afc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d1b725ea5d104caea250427899f4e2e3ab15b4fc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.10.33\",\n                            \"lessThan\": \"5.11\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.11.17\",\n                            \"lessThan\": \"5.12\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/bpf/verifier.c\",\n                        \"tools/testing/selftests/bpf/progs/iters.c\",\n                        \"tools/testing/selftests/bpf/progs/test_global_func16.c\",\n                        \"tools/testing/selftests/bpf/progs/verifier_basic_stack.c\",\n                        \"tools/testing/selftests/bpf/progs/verifier_int_ptr.c\",\n                        \"tools/testing/selftests/bpf/progs/verifier_raw_stack.c\",\n                        \"tools/testing/selftests/bpf/progs/verifier_var_off.c\",\n                        \"tools/testing/selftests/bpf/verifier/atomic_cmpxchg.c\",\n                        \"tools/testing/selftests/bpf/verifier/calls.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.12\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.12\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.191\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.14\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.7.2\",\n                            \"lessThanOrEqual\": \"6.7.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.8\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/bf32eaf5093dc1c24ccc26b14c3422f6dfcc5236","https://git.kernel.org/stable/c/0954982db8283016bf38e9db2da5adf47a102e19","https://git.kernel.org/stable/c/fbcf372c8eda2290470268e0afb5ab5d5f5d5fde","https://git.kernel.org/stable/c/6b4a64bafd107e521c01eec3453ce94a3fb38529"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2023-52452","license":"CVE Program Terms of Use","key":"cve-program:CVE-2023-52452","identifiers":["CVE-2023-52452"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-06T23:27:16.6639299+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-06T23:27:16.6639299+00:00","lastSuccessAt":"2026-11-06T23:27:16.8857572+00:00","error":null,"lastVerifiedAt":"2026-11-06T23:27:16.8857582+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-e3f76855f3f449c8c0427e4ebd06d00838fa519af10fe158fc0ca4a62af0718a-340a45d9017d4f9de046b855ad9d1afbc5c699f0e6a7003981ff3a54ebedd5b3","complete":true,"records":420470,"lastAttemptAt":"2026-11-06T23:27:16.132734+00:00","lastSuccessAt":"2026-11-06T23:27:15.9170833+00:00","error":null,"lastVerifiedAt":"2026-11-06T23:27:16.132734+00:00","snapshotPublishedAt":"2026-11-06T23:24:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d5642b79a2ae4ddba3d9992d8d57acd8","complete":true,"records":13623,"lastAttemptAt":"2026-11-06T23:29:11.0866492+00:00","lastSuccessAt":"2026-11-06T23:29:11.082+00:00","error":null,"lastVerifiedAt":"2026-11-06T23:29:11.082+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-06T23:27:16.6639299+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-06T23:27:16.6639299+00:00","lastSuccessAt":"2026-11-06T23:27:20.1048264+00:00","error":null,"lastVerifiedAt":"2026-11-06T23:27:20.1048275+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-013f7e1725c9415dae3f455b96469e5b","complete":true,"records":13645,"lastAttemptAt":"2026-11-06T23:27:20.7173392+00:00","lastSuccessAt":"2026-11-06T23:04:52.129+00:00","error":null,"lastVerifiedAt":"2026-11-06T23:04:52.129+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-06T23:27:16.5541579+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-06T23:27:16.5541579+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-06T23:27:16.3219463+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-06T23:27:16.3219463+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-06T23:27:16.5695788+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-06T23:27:16.5695788+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-8ed23527317690903360c28c8fc7d29caed4a89d648731bf0cfe3e05f1ef5e65","complete":true,"records":231291,"lastAttemptAt":"2026-11-06T23:27:16.4450624+00:00","lastSuccessAt":"2026-11-06T23:04:49.1141425+00:00","error":null,"lastVerifiedAt":"2026-11-06T23:27:16.4450624+00:00","snapshotPublishedAt":"2026-11-06T22:32:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}