{"id":"CVE-2023-2163","published":"2023-09-20T05:02:38Z","modified":"2025-02-27T20:49:30Z","title":"Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation","vendor":"Linux","product":"Linux Kernel","tier":"core","eol":null,"affectedVersions":[{"vendor":"Linux","product":"Linux Kernel","versions":["< 71b547f561247897a0a14f3082730156c0533fed"]}],"description":{"text":"Incorrect verifier pruning in BPF in Linux Kernel >=5.4 leads to unsafe\ncode paths being incorrectly marked as safe, resulting in arbitrary read/write in\nkernel memory, lateral privilege escalation, and container escape.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03635,"percentile":0.89522,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-09-03","exploitedFirstSeen":"2025-09-03","ransomware":false,"evidence":[{"url":"https://hs-8813571.f.hubspotemail.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250903.pdf","date":"2025-09-03"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"ACTUALIZACION | : Long Term Support Channel Update | ChromeOS","url":"https://otx.alienvault.com/pulse/65243c943c9f3a5af243ceab","created":"2023-10-09"},{"name":"ACTUALIZACION |  Linux kernel (IBM) vulnerabilities | Ubuntu","url":"https://otx.alienvault.com/pulse/64ff39511b3ca3f39ade2907","created":"2023-09-11"}],"provenance":"machine"},"cwes":[{"id":"CWE-682","name":"Incorrect Calculation"}],"references":[{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=71b547f561247897a0a14f3082730156c0533fed","tags":[]},{"url":"https://bughunters.google.com/blog/6303226026131456/a-deep-dive-into-cve-2023-2163-how-we-found-and-fixed-an-ebpf-linux-kernel-vulnerability","tags":["technical-description"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-33680","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-33680","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2024-11-27","earliestUrl":"https://github.com/letsr00t/CVE-2023-2163","repos":[{"name":"letsr00t/CVE-2023-2163","url":"https://github.com/letsr00t/CVE-2023-2163","stars":1,"created":"2024-11-27"}]},"first":{"date":"2024-11-27","source":"PoC-in-GitHub","url":"https://github.com/letsr00t/CVE-2023-2163"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2023-09-20","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-2163","provenance":"source"},{"date":"2024-11-27","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/letsr00t/CVE-2023-2163","provenance":"source"},{"date":"2025-09-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://hs-8813571.f.hubspotemail.net/hubfs/8813571/PERISCOPE_VULNINTEL_20250903.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":434,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":66.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 421 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":17.9,"detail":"percentile 0.8952"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}