{"id":"CVE-2023-2163","published":"2023-09-20T05:02:38Z","modified":"2025-02-27T20:49:30Z","title":"Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation","vendor":"Linux","product":"Linux Kernel","tier":"core","eol":null,"affectedVersions":[{"vendor":"Linux","product":"Linux Kernel","versions":["< 71b547f561247897a0a14f3082730156c0533fed"]}],"description":{"text":"Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe\ncode paths being incorrectly marked as safe, resulting in arbitrary read/write in\nkernel memory, lateral privilege escalation, and container escape.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is incorrect verifier pruning in the BPF subsystem of the Linux Kernel (5.4 and later), where unsafe code paths are wrongly marked as safe by the verifier. An attacker who can get a BPF program loaded can use this to gain arbitrary read/write access to kernel memory, enabling lateral privilege escalation and container escape, with no authentication or user interaction required over the network-reachable attack path.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T12:59:54Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03635,"percentile":0.89537,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-09-03","exploitedFirstSeen":"2025-09-03","ransomware":false,"evidence":[{"url":"https://hs-8813571.f.hubspotemail.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250903.pdf","date":"2025-09-03"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"ACTUALIZACION | : Long Term Support Channel Update | ChromeOS","url":"https://otx.alienvault.com/pulse/65243c943c9f3a5af243ceab","created":"2023-10-09"},{"name":"ACTUALIZACION |  Linux kernel (IBM) vulnerabilities | Ubuntu","url":"https://otx.alienvault.com/pulse/64ff39511b3ca3f39ade2907","created":"2023-09-11"}],"provenance":"machine"},"cwes":[{"id":"CWE-682","name":"Incorrect Calculation"}],"references":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=71b547f561247897a0a14f3082730156c0533fed","tags":[]},{"url":"https://bughunters.google.com/blog/6303226026131456/a-deep-dive-into-cve-2023-2163-how-we-found-and-fixed-an-ebpf-linux-kernel-vulnerability","tags":["technical-description"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-33680","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-33680","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-11-27","earliestUrl":"https://github.com/letsr00t/CVE-2023-2163","repos":[{"name":"letsr00t/CVE-2023-2163","url":"https://github.com/letsr00t/CVE-2023-2163","stars":1,"created":"2024-11-27"}]},"first":{"date":"2024-11-27","source":"PoC-in-GitHub","url":"https://github.com/letsr00t/CVE-2023-2163"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-09-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-2163","provenance":"source"},{"date":"2024-11-27","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/letsr00t/CVE-2023-2163","provenance":"source"},{"date":"2025-09-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://hs-8813571.f.hubspotemail.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250903.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":434,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":66.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 423 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":17.91,"detail":"percentile 0.8954"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}