CVE-2023-54181

Vulnerability

A bug in the Linux kernel's BPF verifier caused it to incorrectly reject programs that compare two packet pointers (e.g., checking if (iph + 1) > skb->data_end). The verifier treated such comparisons as a pointer leak, even though comparing two pointers derived from the same packet context does not expose kernel memory addresses. This issue was discovered after a networking BPF program that switched from CAP_SYS_ADMIN to CAP_NET_ADMIN+CAP_BPF started failing with the error "R3 pointer comparison prohibited" [1].

Exploitation

No special privileges beyond those needed to load BPF programs are required to trigger the bug. An attacker who can load a crafted BPF program (e.g., via cls-ingress in tc) could cause the verifier to reject legitimate packet parsing logic, leading to denial of service for network filtering or monitoring functionality. The bug is triggered by any BPF program that performs a relational comparison between two pointers derived from the packet data, such as bounds checking [1].

Impact

The primary impact is denial of service: legitimate BPF programs that perform packet pointer comparisons are rejected by the verifier, preventing them from loading and executing. This can disrupt network security monitoring, traffic shaping, or other BPF-based networking features. There is no evidence of memory corruption or privilege escalation [1].

Mitigation

The fix was committed to the Linux kernel and backport branches for stable kernels, including 6.1.y. Users should apply the kernel patch referenced in the commit [1]. No workaround exists other than updating the kernel or avoiding BPF programs that compare packet pointers from the same packet context.