CVE-2023-54247

What it actually does

Triggers an unnecessary kernel warning in btf_type_id_size() when a DECL_TAG BTF type is referenced via btf_key_type_id or btf_value_type_id during BPF map creation, because the function did not treat DECL_TAG as a size-less modifier type.

Why it matters to the business

Produces spurious warnings in kernel logs for workloads that use BTF metadata with eBPF maps, increasing log noise and potential alert fatigue without affecting system stability, security posture, or application behavior.

How an attack unfolds

An unprivileged process invokes the bpf syscall to create a map while supplying a BTF object containing a DECL_TAG that points to a VAR or STRUCT; the map_check_btf path then calls btf_type_id_size and hits the WARN_ON_ONCE, but the function correctly returns NULL with no further impact or privilege escalation possible.

How to fix it

Upgrade the Linux kernel to a version containing commit 61f4bd46a03a81865aca3bcbad2f7b7032fb3160 or later; for affected distributions also update elfutils to 0.188-2.1+e1 or newer.

How to confirm the fix worked

Confirm the fix commit is present in the running kernel source tree, or execute a test program that creates a BPF map using a DECL_TAG BTF type and verify no warning is logged at btf_type_id_size.

Typical attack path

1. Construct BTF data containing a DECL_TAG type referencing another type
2. Call bpf(BPF_MAP_CREATE) with btf_key_type_id or btf_value_type_id set to the DECL_TAG type ID
3. Observe the kernel warning emitted from btf.c:1988

How to detect it

Search kernel logs (dmesg, journalctl, or /var/log/kern.log) for the exact warning emitted by btf_type_id_size when btf_attr.btf_key_type_id references a DECL_TAG; correlate with processes performing bpf syscalls that supply BTF data.

• WARNING: CPU: .* PID: .* at kernel/bpf/btf.c:1988 btf_type_id_size+0x2d9/0x9d0
• btf_type_id_size+0x2d9/0x9d0 kernel/bpf/btf.c:1988
• map_check_btf kernel/bpf/syscall.c:1024
• DECL_TAG 'a' type_id=4 component_idx=-1

What your security team should do

• Prioritize kernel upgrades on systems that heavily use custom BTF or eBPF tooling
• Add the btf_type_id_size warning string to log monitoring rules until patches are deployed
• Review and prune any internal BTF generation code that emits DECL_TAG entries for map key/value types