In the Linux kernel, the following vulnerability has been resolved:
bpf, verifier: Fix memory leak in array reallocation for stack state
If an error (NULL) is returned by krealloc(), callers of realloc_array() were setting their allocation pointers to NULL, but on error krealloc() does not touch the original allocation. This would result in a memory resource leak. Instead, free the old allocation on the error handling path.
The memory leak information is as follows as also reported by Zhengchao:
unreferenced object 0xffff888019801800 (size 256): comm "bpfrepo", pid 6490, jiffies 4294959200 (age 17.170s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000b211474b>] _kmallocnodetrackcaller+0x45/0xc0 [<0000000086712a0b>] krealloc+0x83/0xd0 [<00000000139aab02>] reallocarray+0x82/0xe2 [<00000000b1ca41d1>] growstackstate+0xfb/0x186 [<00000000cd6f36d2>] checkmemaccess.cold+0x141/0x1341 [<0000000081780455>] docheckcommon+0x5358/0xb350 [<0000000015f6b091>] bpfcheck.cold+0xc3/0x29d [<000000002973c690>] bpfprogload+0x13db/0x2240 [<00000000028d1644>] _sysbpf+0x1605/0x4ce0 [<00000000053f29bd>] _x64sysbpf+0x75/0xb0 [<0000000056fedaf5>] dosyscall64+0x35/0x80 [<000000002bd58261>] entrySYSCALL64afterhwframe+0x63/0xcd
{ "vanir_signatures": [ { "id": "CVE-2022-49878-0c0465ab", "signature_type": "Line", "target": { "file": "kernel/bpf/verifier.c" }, "deprecated": false, "digest": { "line_hashes": [ "10164658385997473613056401483987235067", "52900355233647538110274646087166624309", "202606473048576514969660970564393061778", "40905476158471251056761730978035249520", "293185093536707673925438755084113469952", "156937650465314401689518895167611839865", "245730411495615566909761753879405907358", "314014812409366368124797750585880916515", "319005287035335756998278969047403767959" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42378a9ca55347102bbf86708776061d8fe3ece2" }, { "id": "CVE-2022-49878-27b83755", "signature_type": "Line", "target": { "file": "kernel/bpf/verifier.c" }, "deprecated": false, "digest": { "line_hashes": [ "10164658385997473613056401483987235067", "52900355233647538110274646087166624309", "202606473048576514969660970564393061778", "40905476158471251056761730978035249520", "293185093536707673925438755084113469952", "156937650465314401689518895167611839865", "245730411495615566909761753879405907358", "314014812409366368124797750585880916515", "319005287035335756998278969047403767959" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e210891c4a4c2d858cd6f9f61d5809af251d4df" }, { "id": "CVE-2022-49878-4993123e", "signature_type": "Function", "target": { "file": "kernel/bpf/verifier.c", "function": "realloc_array" }, "deprecated": false, "digest": { "length": 353.0, "function_hash": "103110647073954972483202333166811996090" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06615967d4889b08b19ff3dda96e8b131282f73d" }, { "id": "CVE-2022-49878-b378bc33", "signature_type": "Line", "target": { "file": "kernel/bpf/verifier.c" }, "deprecated": false, "digest": { "line_hashes": [ "10164658385997473613056401483987235067", "52900355233647538110274646087166624309", "202606473048576514969660970564393061778", "40905476158471251056761730978035249520", "293185093536707673925438755084113469952", "156937650465314401689518895167611839865", "245730411495615566909761753879405907358", "314014812409366368124797750585880916515", "319005287035335756998278969047403767959" ], "threshold": 0.9 }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@06615967d4889b08b19ff3dda96e8b131282f73d" }, { "id": "CVE-2022-49878-bbecac46", "signature_type": "Function", "target": { "file": "kernel/bpf/verifier.c", "function": "realloc_array" }, "deprecated": false, "digest": { "length": 353.0, "function_hash": "103110647073954972483202333166811996090" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42378a9ca55347102bbf86708776061d8fe3ece2" }, { "id": "CVE-2022-49878-d9fdff9d", "signature_type": "Function", "target": { "file": "kernel/bpf/verifier.c", "function": "realloc_array" }, "deprecated": false, "digest": { "length": 353.0, "function_hash": "103110647073954972483202333166811996090" }, "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3e210891c4a4c2d858cd6f9f61d5809af251d4df" } ] }