CVE-2023-54173

Vulnerability

CVE-2023-54173 is a vulnerability in the Linux kernel's BPF subsystem, specifically in the bpf_event_output function. The root cause is that this function uses nesting protection without disabling preemption, which can lead to a race condition. When bpf_event_output is called by programs executed via bpf_prog_run_array_cg, migration is disabled but preemption remains enabled. This allows a task to be preempted inside the nesting protection, potentially causing two tasks to concurrently use the same perf_sample_data buffer [1].

Exploitation

An attacker with the capability to load and execute BPF programs that trigger bpf_event_output could exploit this race condition. The attack surface includes BPF programs attached to cgroup hooks (e.g., socket connect filters), which are commonly used in container environments. No authentication beyond the ability to load BPF programs is required; in many setups, this is restricted to privileged users.

Impact

Successful exploitation can cause a kernel NULL pointer dereference, leading to a denial of service (system crash). The crash trace shows a fault in perf_output_sample and related functions, confirming that the race corrupts kernel memory [1]. The vulnerability was discovered in a Cilium issue [1], indicating it is exploitable in real-world deployments that rely on BPF for networking.

Mitigation

The fix disables preemption inside bpf_event_output, preventing the race condition. The patch was committed to the Linux kernel stable tree on 2025-12-30 [1][2]. Users should apply the kernel update that includes this commit. No workaround is available; the vulnerability is fixed in the kernel source.