CVE-2023-54145
In the Linux kernel, the following vulnerability has been resolved: bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log It's trivial for user to trigger "verifier log line truncated" warning, as verifier has a fixed-sized buffer of 1024 bytes (as of now), and there are at least two pieces of user-provided information that can be output through this buffer, and both can be arbitrarily sized by user: - BTF names; - BTF.ext source code lines strings. Verifier log buffer should be properly sized for typical verifier state output. But it's sort-of expected that this buffer won't be long enough in some circumstances. So let's drop the check. In any case code will work correctly, at worst truncating a part of a single line output.
Affected versions
Linux kernel versions
4.15
and later are affected. Fixed in
6.1.107,
6.4.7,
6.5
and their respective stable series.
References
The following references provide additional information about CVE-2023-54145 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/40c88c429a598006f91ad7a2b89856cd50b3a008
-
PatchKernel patch commithttps://git.kernel.org/stable/c/926a175026fed5d534f587ea4ec3ec49265cd3c5
-
PatchKernel patch commithttps://git.kernel.org/stable/c/cff36398bd4c7d322d424433db437f3c3391c491
Frequently asked questions
-
What is CVE-2023-54145?
CVE-2023-54145 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.15 onward and has been patched in 6.1.107, 6.4.7 and 6.5. CVE-2023-54145 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2023-54145?
Yes — CVE-2023-54145 has been patched. Fixed versions include 6.1.107, 6.4.7 and 6.5. If you are running Linux kernel 4.15 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2023-54145 actively exploited?
No — CVE-2023-54145 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.