From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CAC8C25A331 for ; Fri, 2 May 2025 15:58:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746201508; cv=none; b=M5cvFHmNszpQnn0VtvBiTLA9gxTR0LwXZuj2o+2ZU53CuOzrO4eHie7/OwGUarABeIuZkkx/O8CHuBbHn1Kl/rsnvxRwWg+RwihPpwDw/29tRiVZqC2LPxk5lX1yUKv9O7CKb04GRBG/UHrvbtNXtWFwPPK15fY0Zo1RmQoplOM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746201508; c=relaxed/simple; bh=JfkZUShnKuDN+gZM8RZdQqHY9vUNhgcax9CsK8LgO4U=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=W6Qe52d7BCVYKsFRwqDCGmkE2AYUNtUZ5cy1mcrgTil1yt5FykgitSu+ZsVZqk/FLKhHivtxJR1c2eBj7nmtxlaqC5tU+r//KUFzNrsN/k1Uirq7FMDbmUPZmvpywgEYm+OmZZKxH7bfUEoOATkBCo/IN6/Jo11pUGBlRrAVUTc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=1T2WbYv/; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="1T2WbYv/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CEADBC4CEE4; Fri, 2 May 2025 15:58:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1746201508; bh=JfkZUShnKuDN+gZM8RZdQqHY9vUNhgcax9CsK8LgO4U=; h=From:To:Cc:Subject:Date:Reply-to:From; b=1T2WbYv/UxLRRurzOwE/8nCnB+u+FaXgQshZjYmsEZxiTAull2HbRATKS2fKT9j/x m/RuQ+5UBsQAD0HXCODQS2EwL76+5ST7ux7z60di6ebsVP1Rra+dniAjPjvCqCiAYQ VwBb+4OrKaMU+vicoVTFbdybXaA9H0aiEXQSVlkg= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2023-53076: bpf: Adjust insufficient default bpf_jit_limit Date: Fri, 2 May 2025 17:55:41 +0200 Message-ID: <2025050215-CVE-2023-53076-d1a7@gregkh> X-Mailer: git-send-email 2.49.0 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=5348; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=vjObKGBo/u/jPr6ttqQikF2d6DgjHZjCyu0hw+9K/qI=; b=owGbwMvMwCRo6H6F97bub03G02pJDBkirx4/dAsN4Drwz+Pnl2619Y/vbdm5qTw3vdhI66LZ6 p2nOFau7YhlYRBkYpAVU2T5so3n6P6KQ4pehranYeawMoEMYeDiFICJFPxnmB8i9qV8Zdv2rVuc PuU8iHVJ1fewqWRYcOL8u/uxpxbrGjLtvtBdp339RCHXdQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: bpf: Adjust insufficient default bpf_jit_limit We've seen recent AWS EKS (Kubernetes) user reports like the following: After upgrading EKS nodes from v20230203 to v20230217 on our 1.24 EKS clusters after a few days a number of the nodes have containers stuck in ContainerCreating state or liveness/readiness probes reporting the following error: Readiness probe errored: rpc error: code = Unknown desc = failed to exec in container: failed to start exec "4a11039f730203ffc003b7[...]": OCI runtime exec failed: exec failed: unable to start container process: unable to init seccomp: error loading seccomp filter into kernel: error loading seccomp filter: errno 524: unknown However, we had not been seeing this issue on previous AMIs and it only started to occur on v20230217 (following the upgrade from kernel 5.4 to 5.10) with no other changes to the underlying cluster or workloads. We tried the suggestions from that issue (sysctl net.core.bpf_jit_limit=452534528) which helped to immediately allow containers to be created and probes to execute but after approximately a day the issue returned and the value returned by cat /proc/vmallocinfo | grep bpf_jit | awk '{s+=$2} END {print s}' was steadily increasing. I tested bpf tree to observe bpf_jit_charge_modmem, bpf_jit_uncharge_modmem their sizes passed in as well as bpf_jit_current under tcpdump BPF filter, seccomp BPF and native (e)BPF programs, and the behavior all looks sane and expected, that is nothing "leaking" from an upstream perspective. The bpf_jit_limit knob was originally added in order to avoid a situation where unprivileged applications loading BPF programs (e.g. seccomp BPF policies) consuming all the module memory space via BPF JIT such that loading of kernel modules would be prevented. The default limit was defined back in 2018 and while good enough back then, we are generally seeing far more BPF consumers today. Adjust the limit for the BPF JIT pool from originally 1/4 to now 1/2 of the module memory space to better reflect today's needs and avoid more users running into potentially hard to debug issues. The Linux kernel CVE team has assigned CVE-2023-53076 to this issue. Affected and fixed versions =========================== Issue introduced in 4.14.140 with commit 2d45c6f193789c6b610d734997a2f4cdebec4e37 and fixed in 4.14.312 with commit 374ed036309fce73f9db04c3054018a71912d46b Issue introduced in 4.19.58 with commit 54e8cf41b20b9e9952c7e563794efcbc5d47e891 and fixed in 4.19.280 with commit 42049e65d338870e93732b0b80c6c41faf6aa781 Issue introduced in 4.20 with commit fdadd04931c2d7cd294dc5b2b342863f94be53a3 and fixed in 5.4.240 with commit d69c2ded95b17d51cc6632c7848cbd476381ecd6 Issue introduced in 4.20 with commit fdadd04931c2d7cd294dc5b2b342863f94be53a3 and fixed in 5.10.177 with commit a4bbab27c4bf69486f5846d44134eb31c37e9b22 Issue introduced in 4.20 with commit fdadd04931c2d7cd294dc5b2b342863f94be53a3 and fixed in 5.15.105 with commit 54869daa6a437887614274f65298ba44a3fac63a Issue introduced in 4.20 with commit fdadd04931c2d7cd294dc5b2b342863f94be53a3 and fixed in 6.1.22 with commit 9cda812c76067c8a771eae43bb6943481cc7effc Issue introduced in 4.20 with commit fdadd04931c2d7cd294dc5b2b342863f94be53a3 and fixed in 6.2.9 with commit 68ed00a37d2d1c932ff7be40be4b90c4bec48c56 Issue introduced in 4.20 with commit fdadd04931c2d7cd294dc5b2b342863f94be53a3 and fixed in 6.3 with commit 10ec8ca8ec1a2f04c4ed90897225231c58c124a7 Issue introduced in 4.9.190 with commit 6c1dc8f96b54ad9e63ef3becac73750a588abe6e Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2023-53076 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: kernel/bpf/core.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/374ed036309fce73f9db04c3054018a71912d46b https://git.kernel.org/stable/c/42049e65d338870e93732b0b80c6c41faf6aa781 https://git.kernel.org/stable/c/d69c2ded95b17d51cc6632c7848cbd476381ecd6 https://git.kernel.org/stable/c/a4bbab27c4bf69486f5846d44134eb31c37e9b22 https://git.kernel.org/stable/c/54869daa6a437887614274f65298ba44a3fac63a https://git.kernel.org/stable/c/9cda812c76067c8a771eae43bb6943481cc7effc https://git.kernel.org/stable/c/68ed00a37d2d1c932ff7be40be4b90c4bec48c56 https://git.kernel.org/stable/c/10ec8ca8ec1a2f04c4ed90897225231c58c124a7