{
   "containers": {
      "cna": {
         "providerMetadata": {
            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
         },
         "descriptions": [
            {
               "lang": "en",
               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Annotate bpf_long_memcpy with data_race\n\nsyzbot reported a data race splat between two processes trying to\nupdate the same BPF map value via syscall on different CPUs:\n\n  BUG: KCSAN: data-race in bpf_percpu_array_update / bpf_percpu_array_update\n\n  write to 0xffffe8fffe7425d8 of 8 bytes by task 8257 on cpu 1:\n   bpf_long_memcpy include/linux/bpf.h:428 [inline]\n   bpf_obj_memcpy include/linux/bpf.h:441 [inline]\n   copy_map_value_long include/linux/bpf.h:464 [inline]\n   bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380\n   bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175\n   generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749\n   bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648\n   __sys_bpf+0x28a/0x780\n   __do_sys_bpf kernel/bpf/syscall.c:5241 [inline]\n   __se_sys_bpf kernel/bpf/syscall.c:5239 [inline]\n   __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239\n   do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n   do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\n   entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\n  write to 0xffffe8fffe7425d8 of 8 bytes by task 8268 on cpu 0:\n   bpf_long_memcpy include/linux/bpf.h:428 [inline]\n   bpf_obj_memcpy include/linux/bpf.h:441 [inline]\n   copy_map_value_long include/linux/bpf.h:464 [inline]\n   bpf_percpu_array_update+0x3bb/0x500 kernel/bpf/arraymap.c:380\n   bpf_map_update_value+0x190/0x370 kernel/bpf/syscall.c:175\n   generic_map_update_batch+0x3ae/0x4f0 kernel/bpf/syscall.c:1749\n   bpf_map_do_batch+0x2df/0x3d0 kernel/bpf/syscall.c:4648\n   __sys_bpf+0x28a/0x780\n   __do_sys_bpf kernel/bpf/syscall.c:5241 [inline]\n   __se_sys_bpf kernel/bpf/syscall.c:5239 [inline]\n   __x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5239\n   do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n   do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80\n   entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\n  value changed: 0x0000000000000000 -> 0xfffffff000002788\n\nThe bpf_long_memcpy is used with 8-byte aligned pointers, power-of-8 size\nand forced to use long read/writes to try to atomically copy long counters.\nIt is best-effort only and no barriers are here since it _will_ race with\nconcurrent updates from BPF programs. The bpf_long_memcpy() is called from\nbpf(2) syscall. Marco suggested that the best way to make this known to\nKCSAN would be to use data_race() annotation."
            }
         ],
         "affected": [
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "versions": [
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "5685f8a6fae1",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "e562de67dc91",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "1da177e4c3f4",
                     "lessThan": "6a86b5b5cd76",
                     "status": "affected",
                     "versionType": "git"
                  }
               ]
            },
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "affected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "versions": [
                  {
                     "version": "6.1.56",
                     "lessThanOrEqual": "6.1.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.5.6",
                     "lessThanOrEqual": "6.5.*",
                     "status": "unaffected",
                     "versionType": "custom"
                  },
                  {
                     "version": "6.6",
                     "lessThanOrEqual": "*",
                     "status": "unaffected",
                     "versionType": "original_commit_for_fix"
                  }
               ]
            }
         ],
         "references": [
            {
               "url": "https://git.kernel.org/stable/c/5685f8a6fae1fbe480493b980a1fdbe67c86a094"
            },
            {
               "url": "https://git.kernel.org/stable/c/e562de67dc9196f2415f117796a2108c00ac7fc6"
            },
            {
               "url": "https://git.kernel.org/stable/c/6a86b5b5cd76d2734304a0173f5f01aa8aa2025e"
            }
         ],
         "title": "bpf: Annotate bpf_long_memcpy with data_race",
         "x_generator": {
            "engine": "bippy-4986f5686161"
         }
      }
   },
   "cveMetadata": {
      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
      "cveID": "CVE-2023-52521",
      "requesterUserId": "gregkh@kernel.org",
      "serial": "1",
      "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",
   "dataVersion": "5.0"
}