CVE-2022-3606: Linux Kernel BPF libbpf.c find_prog_by_sec_insn null pointer dereference
A vulnerability was found in Linux Kernel. It has been classified as problematic. This affects the function findprogbysecinsn of the file tools/lib/bpf/libbpf.c of the component BPF. The manipulation leads to null pointer dereference. It is recommended to apply a patch to fix this issue. The identifier VDB-211749 was assigned to this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libbpfto a version that resolves this vulnerability.Fixed in 1.1.2-0+deb12u1Fixed in 1.5.0-3Fixed in 1.7.0-1 - Upgrade
Upgrade
debian/libbpfto a version that resolves this vulnerability.Fixed in 1.1.0-1
Event History
Frequently Asked Questions
What access does an attacker need to trigger this issue?
The reported CVSS vector requires local access and low privileges, with no user interaction required. The stated impact is denial of service through a null pointer dereference; no confidentiality or integrity impact is listed.
Which component should be prioritized for remediation?
The affected code is find_prog_by_sec_insn in tools/lib/bpf/libbpf.c, within the BPF component. The listed software includes Debian libbpf and the Linux kernel.
Is a patch available?
Yes. The vulnerability information recommends applying a patch, and a referenced BPF commit is provided as remediation information.