CVE-2022-49873: bpf: Fix wrong reg type conversion in release_reference()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix wrong reg type conversion in releasereference()
Some helper functions will allocate memory. To avoid memory leaks, the verifier requires the eBPF program to release these memories by calling the corresponding helper functions.
When a resource is released, all pointer registers corresponding to the resource should be invalidated. The verifier use releasereferences() to do this job, by apply markregunknown() to each relevant register.
It will give these registers the type of SCALARVALUE. A register that will contain a pointer value at runtime, but of type SCALARVALUE, which may allow the unprivileged user to get a kernel pointer by storing this register into a map.
Using markregnotinit() while NOT allowptrleaks can mitigate this problem.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49873?
CVE-2022-49873 has a low severity rating due to the specific conditions required for exploitation.
How do I fix CVE-2022-49873?
To fix CVE-2022-49873, update to the latest version of the Linux Kernel where the vulnerability has been patched.
What does CVE-2022-49873 affect?
CVE-2022-49873 affects the Linux Kernel, specifically the eBPF program memory handling.
Is CVE-2022-49873 exploitable remotely?
CVE-2022-49873 is not known to be remotely exploitable as it requires specific conditions in local execution.
What can happen if CVE-2022-49873 is exploited?
If CVE-2022-49873 is exploited, it can lead to memory leaks and potential stability issues in the affected system.