CVE-2023-2163

What it actually does

Incorrect verifier pruning in BPF allows unsafe code paths to be incorrectly marked as safe, enabling arbitrary kernel memory read/write.

Why it matters to the business

Attackers with local access can escalate privileges, escape containers, and fully compromise affected Linux systems; high prevalence in cloud and container environments increases urgency despite low EPSS.

How an attack unfolds

An attacker with local access loads a crafted BPF program that triggers the pruning flaw, resulting in kernel memory corruption for privilege escalation or container escape.

How to fix it

Upgrade the Linux kernel to commit 71b547f561247897a0a14f3082730156c0533fed or later versions containing the fix.

How to confirm the fix worked

Verify the running kernel includes commit 71b547f561247897a0a14f3082730156c0533fed; confirm absence of the pruning flaw via source inspection or kernel self-tests.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Load a malicious BPF program exploiting the verifier pruning error
3. Achieve arbitrary kernel read/write
4. Escalate to root or escape container

How to detect it

Review audit logs and kernel messages for unusual BPF program loads or verifier warnings around the time of suspected exploitation.

What your security team should do

• Apply the kernel fix immediately on all affected systems given the 1122 days since publication
• Restrict unprivileged BPF loading via sysctl where feasible
• Monitor kernel logs for anomalous verifier or BPF activity