CVE-2022-48929

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48929
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix crash due to out of bounds access into reg2btf_ids. When commit e6ac2450d6de ("bpf: Support bpf program calling kernel function") added kfunc support, it defined reg2btf_ids as a cheap way to translate the verifier reg type to the appropriate btf_vmlinux BTF ID, however commit c25b2ae13603 ("bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL") moved the __BPF_REG_TYPE_MAX from the last member of bpf_reg_type enum to after the base register types, and defined other variants using type flag composition. However, now, the direct usage of reg->type to index into reg2btf_ids may no longer fall into __BPF_REG_TYPE_MAX range, and hence lead to out of bounds access and kernel crash on dereference of bad pointer.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/45ce4b4f9009102cd9f581196d480a59208690c1 Patch
https://git.kernel.org/stable/c/8c39925e98d498b9531343066ef82ae39e41adae Patch
https://git.kernel.org/stable/c/f0ce1bc9e0235dd7412240be493d7ea65ed9eadc Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

23 Aug 2024, 02:00

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-125
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/45ce4b4f9009102cd9f581196d480a59208690c1 - () https://git.kernel.org/stable/c/45ce4b4f9009102cd9f581196d480a59208690c1 - Patch
References () https://git.kernel.org/stable/c/8c39925e98d498b9531343066ef82ae39e41adae - () https://git.kernel.org/stable/c/8c39925e98d498b9531343066ef82ae39e41adae - Patch
References () https://git.kernel.org/stable/c/f0ce1bc9e0235dd7412240be493d7ea65ed9eadc - () https://git.kernel.org/stable/c/f0ce1bc9e0235dd7412240be493d7ea65ed9eadc - Patch

22 Aug 2024, 12:48

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: bpf: Se corrigió el bloqueo debido al acceso fuera de los límites a reg2btf_ids. Cuando el commit e6ac2450d6de ("bpf: admite la función del kernel que llama al programa bpf") agregó soporte para kfunc, definió reg2btf_ids como una forma económica de traducir el tipo de registro del verificador al ID de BTF btf_vmlinux apropiado; sin embargo, commit c25b2ae13603 ("bpf: reemplace PTR_TO_XXX_OR_NULL con PTR_TO_XXX | PTR_MAYBE_NULL") movió __BPF_REG_TYPE_MAX del último miembro de la enumeración bpf_reg_type a después de los tipos de registro base y definió otras variantes utilizando la composición de indicadores de tipo. Sin embargo, ahora, el uso directo de reg->type para indexar en reg2btf_ids ya no puede caer en el rango __BPF_REG_TYPE_MAX y, por lo tanto, provocar un acceso fuera de los límites y un bloqueo del kernel al desreferenciar un puntero incorrecto.

22 Aug 2024, 04:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-22 04:15

Updated : 2024-08-23 02:00

NVD link : CVE-2022-48929

Mitre link : CVE-2022-48929

CVE.ORG link : CVE-2022-48929

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read