CVE-2022-48929

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-48929
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48929.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-48929
Downstream
Related
Published
2024-08-22T03:31:22Z
Modified
2025-10-21T08:36:16.806912Z
Summary
bpf: Fix crash due to out of bounds access into reg2btf_ids.
Details

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix crash due to out of bounds access into reg2btf_ids.

When commit e6ac2450d6de ("bpf: Support bpf program calling kernel function") added kfunc support, it defined reg2btfids as a cheap way to translate the verifier reg type to the appropriate btfvmlinux BTF ID, however commit c25b2ae13603 ("bpf: Replace PTRTOXXXORNULL with PTRTOXXX | PTRMAYBENULL") moved the _BPFREGTYPEMAX from the last member of bpfregtype enum to after the base register types, and defined other variants using type flag composition. However, now, the direct usage of reg->type to index into reg2btfids may no longer fall into _BPFREGTYPE_MAX range, and hence lead to out of bounds access and kernel crash on dereference of bad pointer.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
8d38cde47a7e17b646401fa92d916503caa5375e
Fixed
8c39925e98d498b9531343066ef82ae39e41adae
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
77459bc4d5e2c6f24db845780b4d9d60cf82d06a
Fixed
f0ce1bc9e0235dd7412240be493d7ea65ed9eadc
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c25b2ae136039ffa820c26138ed4a5e5f3ab3841
Fixed
45ce4b4f9009102cd9f581196d480a59208690c1

Affected versions

v5.*

v5.16
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.16.11
v5.17-rc1
v5.17-rc2
v5.17-rc3

Database specific

vanir_signatures

[
    {
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c39925e98d498b9531343066ef82ae39e41adae",
        "id": "CVE-2022-48929-0f5dd97d",
        "digest": {
            "line_hashes": [
                "185735859717445478909909342215418363322",
                "315388050336316607651820517699071819912",
                "211244977719919913790278234222888577978",
                "293119958814196362193739649620201967036",
                "217245959276309487064414807196912612473",
                "112597146718969015299922191745875312170"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "kernel/bpf/btf.c"
        },
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45ce4b4f9009102cd9f581196d480a59208690c1",
        "id": "CVE-2022-48929-337d5750",
        "digest": {
            "function_hash": "332157509082863023888858242331497814502",
            "length": 3190.0
        },
        "target": {
            "function": "btf_check_func_arg_match",
            "file": "kernel/bpf/btf.c"
        },
        "signature_type": "Function",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c39925e98d498b9531343066ef82ae39e41adae",
        "id": "CVE-2022-48929-98ac1719",
        "digest": {
            "function_hash": "92513341473729784121443978447738506768",
            "length": 2978.0
        },
        "target": {
            "function": "btf_check_func_arg_match",
            "file": "kernel/bpf/btf.c"
        },
        "signature_type": "Function",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45ce4b4f9009102cd9f581196d480a59208690c1",
        "id": "CVE-2022-48929-d8c8be50",
        "digest": {
            "line_hashes": [
                "2098312279920638925621058775474848170",
                "29171577621517709889959052017641904616",
                "13192778087237826027751481543691687042",
                "181323938978567283946822953534466731932",
                "305570803095730273762315165292407664410",
                "254587448695114794644501988218421765594",
                "208613901341212872792924409347614742976",
                "238142163886220055119019254554972492343"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "kernel/bpf/btf.c"
        },
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0ce1bc9e0235dd7412240be493d7ea65ed9eadc",
        "id": "CVE-2022-48929-ed0a24c2",
        "digest": {
            "line_hashes": [
                "120881531066431358252801400411810331967",
                "320549989309562310546525382297587691975",
                "13192778087237826027751481543691687042",
                "181323938978567283946822953534466731932",
                "305570803095730273762315165292407664410",
                "254587448695114794644501988218421765594",
                "208613901341212872792924409347614742976",
                "238142163886220055119019254554972492343"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "kernel/bpf/btf.c"
        },
        "signature_type": "Line",
        "signature_version": "v1"
    },
    {
        "deprecated": false,
        "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0ce1bc9e0235dd7412240be493d7ea65ed9eadc",
        "id": "CVE-2022-48929-ff9fcd1f",
        "digest": {
            "function_hash": "332157509082863023888858242331497814502",
            "length": 3190.0
        },
        "target": {
            "function": "btf_check_func_arg_match",
            "file": "kernel/bpf/btf.c"
        },
        "signature_type": "Function",
        "signature_version": "v1"
    }
]

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.16.11
Fixed
5.16.12