Re: CVE-2023-52920: bpf: support non-r10 register spill/fill to/from stack in precision tracking

[Tao Lyu]

>> Hi Andrii and Eduard,
>
> Hi Shung-Hsi,
>
>> I'm trying to determine the security implication of CVE-2023-52920, or
>> more specifically, what does commit 41f6f64e6999 ("bpf: support non-r10
>> register spill/fill to/from stack in precision tracking") fix.
>> Superficially this looks more like an improvement to the verifier.
>
> It is my understanding as well, that this commit is an optimization to
> avoid some precision marks. I do not see any security implications.
>
> Thanks,
> Eduard
> 
> [...]

Hi Andrii, Eduard, and Shung-Hsi,

The previous discussion is here: https://lore.kernel.org/bpf/20231020155842.130257-1-tao.lyu@xxxxxxx/ 

In short, without this patch, the verifier will miss checking an execution path that can have out-of-bound access,
which eventually leads to privilege escalation, like obtaining the root privilege.

Best,
Tao