LiveActive security incident?Get immediate response
CVE Record

CVE-2023-52462: bpf: fix check for attempt to corrupt spilled pointer

In the Linux kernel, the following vulnerability has been resolved: bpf: fix check for attempt to corrupt spilled pointer When register is spilled onto a stack as a 1/2/4-byte register, we set slot_type[BPF_REG_SIZE - 1] (plus potentially few more below it, depending on actual spill size). So to check if some stack slot has spilled register we need to consult slot_type[7], not slot_type[0]. To avoid the need to remember and double-check this in the future, just use is_spilled_reg() helper.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2023-52462 is a Linux kernel eBPF verifier flaw involving how spilled pointer state is checked on the stack. The public record does not provide a CVSS score or confirmed impact. Treat it as a kernel maintenance risk, especially on systems where users or workloads can load BPF programs.

Executive priority

Schedule this with kernel patch management rather than emergency response unless your environment exposes BPF to untrusted users. The lack of CVSS and exploitation evidence limits urgency, but kernel-level issues deserve timely remediation.

Technical view

The fix changes BPF stack-slot validation to check the correct spilled-register marker using is_spilled_reg(). The bug concerned 1, 2, or 4-byte register spills and an incorrect slot_type index when detecting attempts to corrupt a spilled pointer.

Likely exposure

Exposure appears limited to Linux kernels in the affected version ranges named by the CVE record. Practical exposure depends on kernel version, distribution backports, and whether local users, containers, or agents can exercise BPF functionality.

Exploitation context

The source bundle does not show CISA KEV listing, public exploitation, exploit code, or a vendor impact statement. Because this is kernel BPF verifier logic, any security assessment should focus on local access and BPF-loading permissions.

Researcher notes

The key evidence is the upstream fix description, not a detailed exploitability analysis. Avoid assuming privilege escalation or denial of service without more vendor evidence. Validate by source commit presence, distro changelog, or package advisory rather than version string alone.

Mitigation direction

  • Inventory Linux kernel versions across servers, containers hosts, and appliances.
  • Apply vendor kernel updates containing the referenced stable fixes.
  • Check distribution advisories for backported fixes and package names.
  • Review whether untrusted users or workloads can load BPF programs.
  • Prioritize internet-facing or multi-tenant Linux hosts for patch validation.

Validation and detection

  • Compare running kernel builds against vendor advisories for CVE-2023-52462.
  • Confirm the relevant stable fix is included in deployed kernel packages.
  • Check Debian LTS guidance if using affected Debian kernel packages.
  • Document whether BPF access is restricted for untrusted local users.
  • Run regression testing before broad kernel rollout.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-476: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-52462 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
8Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc
CVECVE Program Container

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcdd73a5ed0840da88a3b9ad353f568e6f156d417, 07c286c10a9cedbd71f20269ff3a4e73d9aab2fe, 27113c59b6d0a587b29ae72d4ff3f832f58b0651, 27113c59b6d0a587b29ae72d4ff3f832f58b0651, 27113c59b6d0a587b29ae72d4ff3f832f58b0651, 27113c59b6d0a587b29ae72d4ff3f832f58b0651unaffected
LinuxLinux5.16, 0, 5.10.209, 5.15.148, 6.1.75, 6.6.14, 6.7.2, 6.8affected
Weakness

CWE details

CWE-476

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.