CyberSecBulletin
CVE-2023-52621NVD status: Analyzed

Linux: Reachable Assertion

Published Updated By the CyberSecBulletin desk

CVE-2023-52621 is a high-severity reachable assertion vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 82f2df94dac1aa9b879e74d1f82ba1b631bdc612, 3516f93cc63d956e1b290ae4b7bf2586074535a0, d6d6fe4bb105595118f12abeed4a7bdd450853f3 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 82f2df94dac1aa9b879e74d1f82ba1b631bdc612 or 3516f93cc63d956e1b290ae4b7bf2586074535a0 or d6d6fe4bb105595118f12abeed4a7bdd450853f3 or 483cb92334cd7f1d5387dccc0ab5d595d27a669d, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.237 or 5.15.181 or 6.1.77 or 6.6.16, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1e6c62a8821557720a9b2ea9617359b264f2f67c up to, but not including, 82f2df94dac1aa9b879e74d1f82ba1b631bdc612; 1e6c62a8821557720a9b2ea9617359b264f2f67c up to, but not including, 3516f93cc63d956e1b290ae4b7bf2586074535a0; 1e6c62a8821557720a9b2ea9617359b264f2f67c up to, but not including, d6d6fe4bb105595118f12abeed4a7bdd450853f3; 1e6c62a8821557720a9b2ea9617359b264f2f67c up to, but not including, 483cb92334cd7f1d5387dccc0ab5d595d27a669d; 1e6c62a8821557720a9b2ea9617359b264f2f67c up to, but not including, c7f1b6146f4a46d727c0d046284c28b6882c6304; 1e6c62a8821557720a9b2ea9617359b264f2f67c up to, but not including, 169410eba271afc9f0fb476d996795aa26770c6d; 5.1082f2df94dac1aa9b879e74d1f82ba1b631bdc612, 3516f93cc63d956e1b290ae4b7bf2586074535a0, d6d6fe4bb105595118f12abeed4a7bdd450853f3, 483cb92334cd7f1d5387dccc0ab5d595d27a669d, c7f1b6146f4a46d727c0d046284c28b6882c6304, 169410eba271afc9f0fb476d996795aa26770c6d
DebianDebian Linux11.0Not stated
LinuxLinux Kernel5.10 up to, but not including, 5.10.237; 5.11 up to, but not including, 5.15.181; 5.16 up to, but not including, 6.1.77; 6.2 up to, but not including, 6.6.16; 6.7 up to, but not including, 6.7.45.10.237, 5.15.181, 6.1.77, 6.6.16, 6.7.4

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers These three bpf_map_{lookup,update,delete}_elem() helpers are also available for sleepable bpf program, so add the corresponding lock assertion for sleepable bpf program, otherwise the following warning will be reported when a sleepable bpf program manipulates bpf map under interpreter mode (aka bpf_jit_enable=0): WARNING: CPU: 3 PID: 4985 at kernel/bpf/helpers.c:40 ...... CPU: 3 PID: 4985 Comm: test_progs Not tainted 6.6.0+ #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) ...... RIP: 0010:bpf_map_lookup_elem+0x54/0x60 ...... Call Trace: <TASK> ? __warn+0xa5/0x240 ? bpf_map_lookup_elem+0x54/0x60 ? report_bug+0x1ba/0x1f0 ? handle_bug+0x40/0x80 ? exc_invalid_op+0x18/0x50 ? asm_exc_invalid_op+0x1b/0x20 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ? rcu_lockdep_current_cpu_online+0x65/0xb0 ? rcu_is_watching+0x23/0x50 ? bpf_map_lookup_elem+0x54/0x60 ? __pfx_bpf_map_lookup_elem+0x10/0x10 ___bpf_prog_run+0x513/0x3b70 __bpf_prog_run32+0x9d/0xd0 ? __bpf_prog_enter_sleepable_recur+0xad/0x120 ? __bpf_prog_enter_sleepable_recur+0x3e/0x120 bpf_trampoline_6442580665+0x4d/0x1000 __x64_sys_getpgid+0x5/0x30 ? do_syscall_64+0x36/0xb0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 </TASK>

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

How developers prevent this class of flaw

  • If the assertion statement is required (e.g., for security or reliability), change the invoking code to avoid the conditions that trigger the assertion.
  • Consider changing the assertion to some other less fatal error. This might not be easy to implement, since other code may be needed to handle the error.
  • Make sensitive open/close operations non-reachable from directly user-controlled data (e.g. open/close resources)

More Reachable Assertion vulnerabilities (CWE-617)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Recent Reachable Assertion vulnerabilities

Spotted an error? Tell us.