linux-cve-announce - CVE-2022-50490: bpf: Propagate error from htab_lock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025100417-CVE-2022-50490-dcd3@gregkh>
Date: Sat,  4 Oct 2025 17:51:15 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50490: bpf: Propagate error from htab_lock_bucket() to userspace

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

bpf: Propagate error from htab_lock_bucket() to userspace

In __htab_map_lookup_and_delete_batch() if htab_lock_bucket() returns
-EBUSY, it will go to next bucket. Going to next bucket may not only
skip the elements in current bucket silently, but also incur
out-of-bound memory access or expose kernel memory to userspace if
current bucket_cnt is greater than bucket_size or zero.

Fixing it by stopping batch operation and returning -EBUSY when
htab_lock_bucket() fails, and the application can retry or skip the busy
batch as needed.

The Linux kernel CVE team has assigned CVE-2022-50490 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.11 with commit 20b6cc34ea74b6a84599c1f8a70f3315b56a1883 and fixed in 5.15.75 with commit 0e13425104903970a5ede853082d3bbb4edec6f3
	Issue introduced in 5.11 with commit 20b6cc34ea74b6a84599c1f8a70f3315b56a1883 and fixed in 5.19.17 with commit 6bfee6eb3d6b96ae730a542909dd22b5f9f50d58
	Issue introduced in 5.11 with commit 20b6cc34ea74b6a84599c1f8a70f3315b56a1883 and fixed in 6.0.3 with commit 4f1f39a8f1ce1b24fee6852d7dcd704ce7c4334d
	Issue introduced in 5.11 with commit 20b6cc34ea74b6a84599c1f8a70f3315b56a1883 and fixed in 6.1 with commit 66a7a92e4d0d091e79148a4c6ec15d1da65f4280

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50490
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	kernel/bpf/hashtab.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0e13425104903970a5ede853082d3bbb4edec6f3
	https://git.kernel.org/stable/c/6bfee6eb3d6b96ae730a542909dd22b5f9f50d58
	https://git.kernel.org/stable/c/4f1f39a8f1ce1b24fee6852d7dcd704ce7c4334d
	https://git.kernel.org/stable/c/66a7a92e4d0d091e79148a4c6ec15d1da65f4280