CVE-2023-54173

What it actually does

Race condition in bpf_event_output due to missing preemption disable during nesting protection allows concurrent tasks to reuse the same perf_sample_data buffer, resulting in NULL pointer dereference or kernel crash when bpf_prog_run_array_cg executes BPF programs.

Why it matters to the business

Unexpected kernel crashes on affected Linux systems can cause service outages, require reboots, and disrupt operations for organizations running workloads that invoke BPF programs for networking or security filtering; urgency is moderate given low exploitability signals and absence from known ransomware campaigns.

How an attack unfolds

An attacker crafts or triggers a BPF program (such as a cgroup socket filter) that calls bpf_event_output; under concurrent execution where preemption remains enabled, task switching inside the critical section causes buffer reuse and a kernel fault. No named threat actors or campaigns are associated with this issue.

How to fix it

Upgrade the Linux kernel package to version 5.10.178-1 or newer on Debian 11 systems; apply the vendor-supplied update that disables preemption inside bpf_event_output.

How to confirm the fix worked

Verify the running kernel version matches or exceeds 5.10.178-1; reproduce the original crash scenario under load if a test harness is available; confirm absence of the preemption-related nesting bug in source or via kernel configuration checks.

Typical attack path

1. Identify or deploy a workload that loads a BPF program using bpf_event_output via bpf_prog_run_array_cg
2. Trigger concurrent socket or cgroup operations while preemption is possible
3. Force preemption inside the nesting-protected section to collide on perf_sample_data
4. Observe resulting kernel NULL pointer dereference and crash

How to detect it

Search kernel logs (kern.log, dmesg, journalctl) for oops messages containing perf_output_sample, bpf_event_output, or NULL pointer dereference during bpf_prog execution; correlate with timestamps of socket or cgroup BPF activity.

• BUG: kernel NULL pointer dereference, address: 0000000000000001
• perf_output_sample+0x12a/0x9a0
• bpf_event_output+0x13a/0x190
• #PF: supervisor instruction fetch in kernel mode

What your security team should do

• Schedule kernel package upgrade to 5.10.178-1 across all Debian 11 instances within standard change windows
• Monitor kernel logs for NULL pointer dereference signatures involving perf_output_sample and bpf_event_output
• Review any custom BPF programs that rely on event output for potential preemption assumptions