CVE-2022-3534: Linux Kernel libbpf btf_dump.c btf_dump_name_dups use after free
A vulnerability classified as critical has been found in Linux Kernel. Affected is the function btfdumpnamedups of the file tools/lib/bpf/btfdump.c of the component libbpf. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211032.
Other sources
A vulnerability has been found in Linux Kernel up to 5.10.162/5.15.85/6.0.15/6.1.1. The impacted element is the function btfdumpnamedups of the file tools/lib/bpf/btfdump.c of the component libbpf. The manipulation leads to use after free. Upgrading to version 5.10.163, 5.15.86, 6.0.16, 6.1.2 and 6.2 is sufficient to resolve this issue. The identifier of the patch is c61650b869e0b6fb0c0a28ed42d928eea969afc8/fbe08093fb2334549859829ef81d42570812597d/8c64a8e76eb85d422af5ec60ccbf26e3ead8c333/a733bf10198eb5bb927890940de8ab457491ed3b/93c660ca40b5d2f7c1b1626e955a8e9fa30e0749. You should upgrade the affected component.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux Kernel (libbpf)to a version that resolves this vulnerability.Fixed in 5.10.163 - Upgrade
Upgrade
Linux Kernel (libbpf)to a version that resolves this vulnerability.Fixed in 5.15.86 - Upgrade
Upgrade
Linux Kernel (libbpf)to a version that resolves this vulnerability.Fixed in 6.0.16 - Upgrade
Upgrade
Linux Kernel (libbpf)to a version that resolves this vulnerability.Fixed in 6.1.2 - Upgrade
Upgrade
Linux Kernel (libbpf)to a version that resolves this vulnerability.Fixed in 6.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch c61650b869e0b6fb0c0a28ed42d928eea969afc8/fbe08093fb2334549859829ef81d42570812597d/8c64a8e76eb85d422af5ec60ccbf26e3ead8c333/a733bf10198eb5bb927890940de8ab457491ed3b/93c660ca40b5d2f7c1b1626e955a8e9fa30e0749
Event History
Frequently Asked Questions
What is the severity of CVE-2022-3534?
CVE-2022-3534 has been classified as a critical vulnerability.
How do I fix CVE-2022-3534?
To address CVE-2022-3534, it is recommended to apply the latest patches provided for the Linux Kernel.
What is the risk associated with CVE-2022-3534?
The risk associated with CVE-2022-3534 involves potential use after free vulnerabilities which can lead to security breaches.
Which component is affected by CVE-2022-3534?
CVE-2022-3534 affects the libbpf component in the Linux Kernel.
What function is vulnerable in CVE-2022-3534?
The function btf_dump_name_dups in tools/lib/bpf/btf_dump.c is vulnerable in CVE-2022-3534.