CVE-2023-54303

The vulnerability exists in the Linux kernel's BPF subsystem, specifically in the bpf_perf_event_output function. The nesting protection in this function relies on disabled preemption, which is guaranteed for kprobes and tracepoints but not for uprobes. When called from uprobes context via bpf_prog_run_array_sleepable, migration is disabled but preemption remains enabled, allowing a task to be preempted within the critical section.

An attacker can exploit this by triggering a uprobe that invokes bpf_perf_event_output. Due to the missing preemption disabling, another task may use the same perf_sample_data buffer concurrently, leading to data races. This can result in kernel crashes, as evidenced by the provided call trace showing an attempt to execute NX-protected memory.

The impact includes denial of service through system crashes, and potentially more severe consequences if an attacker can manipulate the corrupted data. The crash trace indicates a page fault in perf_output_sample, which could be leveraged for privilege escalation if the attacker controls the faulty data.

A fix has been applied in the Linux kernel stable tree by disabling preemption in bpf_perf_event_output. Users are advised to update their kernels to versions containing commit a0ac32cf61e5a76e2429e486925a52ee41dd75e3 or apply the equivalent patch [1].