In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix crash due to out of bounds access into reg2btf_ids.
When commit e6ac2450d6de ("bpf: Support bpf program calling kernel function") added kfunc support, it defined reg2btfids as a cheap way to translate the verifier reg type to the appropriate btfvmlinux BTF ID, however commit c25b2ae13603 ("bpf: Replace PTRTOXXXORNULL with PTRTOXXX | PTRMAYBENULL") moved the _BPFREGTYPEMAX from the last member of bpfregtype enum to after the base register types, and defined other variants using type flag composition. However, now, the direct usage of reg->type to index into reg2btfids may no longer fall into _BPFREGTYPE_MAX range, and hence lead to out of bounds access and kernel crash on dereference of bad pointer.
{ "vanir_signatures": [ { "digest": { "threshold": 0.9, "line_hashes": [ "185735859717445478909909342215418363322", "315388050336316607651820517699071819912", "211244977719919913790278234222888577978", "293119958814196362193739649620201967036", "217245959276309487064414807196912612473", "112597146718969015299922191745875312170" ] }, "target": { "file": "kernel/bpf/btf.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c39925e98d498b9531343066ef82ae39e41adae", "signature_version": "v1", "id": "CVE-2022-48929-0f5dd97d", "signature_type": "Line" }, { "digest": { "length": 3190.0, "function_hash": "332157509082863023888858242331497814502" }, "target": { "file": "kernel/bpf/btf.c", "function": "btf_check_func_arg_match" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45ce4b4f9009102cd9f581196d480a59208690c1", "signature_version": "v1", "id": "CVE-2022-48929-337d5750", "signature_type": "Function" }, { "digest": { "length": 2978.0, "function_hash": "92513341473729784121443978447738506768" }, "target": { "file": "kernel/bpf/btf.c", "function": "btf_check_func_arg_match" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c39925e98d498b9531343066ef82ae39e41adae", "signature_version": "v1", "id": "CVE-2022-48929-98ac1719", "signature_type": "Function" }, { "digest": { "threshold": 0.9, "line_hashes": [ "2098312279920638925621058775474848170", "29171577621517709889959052017641904616", "13192778087237826027751481543691687042", "181323938978567283946822953534466731932", "305570803095730273762315165292407664410", "254587448695114794644501988218421765594", "208613901341212872792924409347614742976", "238142163886220055119019254554972492343" ] }, "target": { "file": "kernel/bpf/btf.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45ce4b4f9009102cd9f581196d480a59208690c1", "signature_version": "v1", "id": "CVE-2022-48929-d8c8be50", "signature_type": "Line" }, { "digest": { "threshold": 0.9, "line_hashes": [ "120881531066431358252801400411810331967", "320549989309562310546525382297587691975", "13192778087237826027751481543691687042", "181323938978567283946822953534466731932", "305570803095730273762315165292407664410", "254587448695114794644501988218421765594", "208613901341212872792924409347614742976", "238142163886220055119019254554972492343" ] }, "target": { "file": "kernel/bpf/btf.c" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0ce1bc9e0235dd7412240be493d7ea65ed9eadc", "signature_version": "v1", "id": "CVE-2022-48929-ed0a24c2", "signature_type": "Line" }, { "digest": { "length": 3190.0, "function_hash": "332157509082863023888858242331497814502" }, "target": { "file": "kernel/bpf/btf.c", "function": "btf_check_func_arg_match" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0ce1bc9e0235dd7412240be493d7ea65ed9eadc", "signature_version": "v1", "id": "CVE-2022-48929-ff9fcd1f", "signature_type": "Function" } ] }