linux-cve-announce - CVE-2022-49548: bpf: Fix potential array overflow in bpf_trampoline_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025022615-CVE-2022-49548-47fe@gregkh>
Date: Wed, 26 Feb 2025 03:13:42 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2022-49548: bpf: Fix potential array overflow in bpf_trampoline_get_progs()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix potential array overflow in bpf_trampoline_get_progs()

The cnt value in the 'cnt >= BPF_MAX_TRAMP_PROGS' check does not
include BPF_TRAMP_MODIFY_RETURN bpf programs, so the number of
the attached BPF_TRAMP_MODIFY_RETURN bpf programs in a trampoline
can exceed BPF_MAX_TRAMP_PROGS.

When this happens, the assignment '*progs++ = aux->prog' in
bpf_trampoline_get_progs() will cause progs array overflow as the
progs field in the bpf_tramp_progs struct can only hold at most
BPF_MAX_TRAMP_PROGS bpf programs.

The Linux kernel CVE team has assigned CVE-2022-49548 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.7 with commit 88fd9e5352fe05f7fe57778293aebd4cd106960b and fixed in 5.10.120 with commit 7f845de2863334bed4f362e95853f5e7bc323737
	Issue introduced in 5.7 with commit 88fd9e5352fe05f7fe57778293aebd4cd106960b and fixed in 5.15.45 with commit e36452d5da6325df7c10cffc60a9e68d21e2606d
	Issue introduced in 5.7 with commit 88fd9e5352fe05f7fe57778293aebd4cd106960b and fixed in 5.17.13 with commit 32c4559c61652f24c9fdd5440342196fe37453bc
	Issue introduced in 5.7 with commit 88fd9e5352fe05f7fe57778293aebd4cd106960b and fixed in 5.18.2 with commit 4f8897bcc20b9ae44758e0572538d741ab66f0dc
	Issue introduced in 5.7 with commit 88fd9e5352fe05f7fe57778293aebd4cd106960b and fixed in 5.19 with commit a2aa95b71c9bbec793b5c5fa50f0a80d882b3e8d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49548
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/bpf/trampoline.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/7f845de2863334bed4f362e95853f5e7bc323737
	https://git.kernel.org/stable/c/e36452d5da6325df7c10cffc60a9e68d21e2606d
	https://git.kernel.org/stable/c/32c4559c61652f24c9fdd5440342196fe37453bc
	https://git.kernel.org/stable/c/4f8897bcc20b9ae44758e0572538d741ab66f0dc
	https://git.kernel.org/stable/c/a2aa95b71c9bbec793b5c5fa50f0a80d882b3e8d