CVE-2022-48929

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-48929
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-48929.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-48929
Downstream
Related
Published
2024-08-22T03:31:22Z
Modified
2025-10-14T21:04:11.401661Z
Summary
bpf: Fix crash due to out of bounds access into reg2btf_ids.
Details

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix crash due to out of bounds access into reg2btf_ids.

When commit e6ac2450d6de ("bpf: Support bpf program calling kernel function") added kfunc support, it defined reg2btfids as a cheap way to translate the verifier reg type to the appropriate btfvmlinux BTF ID, however commit c25b2ae13603 ("bpf: Replace PTRTOXXXORNULL with PTRTOXXX | PTRMAYBENULL") moved the _BPFREGTYPEMAX from the last member of bpfregtype enum to after the base register types, and defined other variants using type flag composition. However, now, the direct usage of reg->type to index into reg2btfids may no longer fall into _BPFREGTYPE_MAX range, and hence lead to out of bounds access and kernel crash on dereference of bad pointer.

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
8d38cde47a7e17b646401fa92d916503caa5375e
Fixed
8c39925e98d498b9531343066ef82ae39e41adae
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
77459bc4d5e2c6f24db845780b4d9d60cf82d06a
Fixed
f0ce1bc9e0235dd7412240be493d7ea65ed9eadc
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c25b2ae136039ffa820c26138ed4a5e5f3ab3841
Fixed
45ce4b4f9009102cd9f581196d480a59208690c1

Affected versions

v5.*

v5.16
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.16.11
v5.17-rc1
v5.17-rc2
v5.17-rc3

Database specific 

{
    "vanir_signatures": [
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "185735859717445478909909342215418363322",
                    "315388050336316607651820517699071819912",
                    "211244977719919913790278234222888577978",
                    "293119958814196362193739649620201967036",
                    "217245959276309487064414807196912612473",
                    "112597146718969015299922191745875312170"
                ]
            },
            "target": {
                "file": "kernel/bpf/btf.c"
            },
            "deprecated": false,
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c39925e98d498b9531343066ef82ae39e41adae",
            "signature_version": "v1",
            "id": "CVE-2022-48929-0f5dd97d",
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 3190.0,
                "function_hash": "332157509082863023888858242331497814502"
            },
            "target": {
                "file": "kernel/bpf/btf.c",
                "function": "btf_check_func_arg_match"
            },
            "deprecated": false,
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45ce4b4f9009102cd9f581196d480a59208690c1",
            "signature_version": "v1",
            "id": "CVE-2022-48929-337d5750",
            "signature_type": "Function"
        },
        {
            "digest": {
                "length": 2978.0,
                "function_hash": "92513341473729784121443978447738506768"
            },
            "target": {
                "file": "kernel/bpf/btf.c",
                "function": "btf_check_func_arg_match"
            },
            "deprecated": false,
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8c39925e98d498b9531343066ef82ae39e41adae",
            "signature_version": "v1",
            "id": "CVE-2022-48929-98ac1719",
            "signature_type": "Function"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "2098312279920638925621058775474848170",
                    "29171577621517709889959052017641904616",
                    "13192778087237826027751481543691687042",
                    "181323938978567283946822953534466731932",
                    "305570803095730273762315165292407664410",
                    "254587448695114794644501988218421765594",
                    "208613901341212872792924409347614742976",
                    "238142163886220055119019254554972492343"
                ]
            },
            "target": {
                "file": "kernel/bpf/btf.c"
            },
            "deprecated": false,
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45ce4b4f9009102cd9f581196d480a59208690c1",
            "signature_version": "v1",
            "id": "CVE-2022-48929-d8c8be50",
            "signature_type": "Line"
        },
        {
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "120881531066431358252801400411810331967",
                    "320549989309562310546525382297587691975",
                    "13192778087237826027751481543691687042",
                    "181323938978567283946822953534466731932",
                    "305570803095730273762315165292407664410",
                    "254587448695114794644501988218421765594",
                    "208613901341212872792924409347614742976",
                    "238142163886220055119019254554972492343"
                ]
            },
            "target": {
                "file": "kernel/bpf/btf.c"
            },
            "deprecated": false,
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0ce1bc9e0235dd7412240be493d7ea65ed9eadc",
            "signature_version": "v1",
            "id": "CVE-2022-48929-ed0a24c2",
            "signature_type": "Line"
        },
        {
            "digest": {
                "length": 3190.0,
                "function_hash": "332157509082863023888858242331497814502"
            },
            "target": {
                "file": "kernel/bpf/btf.c",
                "function": "btf_check_func_arg_match"
            },
            "deprecated": false,
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f0ce1bc9e0235dd7412240be493d7ea65ed9eadc",
            "signature_version": "v1",
            "id": "CVE-2022-48929-ff9fcd1f",
            "signature_type": "Function"
        }
    ]
}

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.16.11
Fixed
5.16.12