CVE-2022-49548

Summary

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix potential array overflow in bpf_trampoline_get_progs()

The cnt value in the 'cnt >= BPF_MAX_TRAMP_PROGS' check does not include BPF_TRAMP_MODIFY_RETURN bpf programs, so the number of the attached BPF_TRAMP_MODIFY_RETURN bpf programs in a trampoline can exceed BPF_MAX_TRAMP_PROGS.

When this happens, the assignment '*progs++ = aux->prog' in bpf_trampoline_get_progs() will cause progs array overflow as the progs field in the bpf_tramp_progs struct can only hold at most BPF_MAX_TRAMP_PROGS bpf programs.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux88fd9e5352fe05f7fe57778293aebd4cd106960b < 7f845de2863334bed4f362e95853f5e7bc323737affected
LinuxLinux88fd9e5352fe05f7fe57778293aebd4cd106960b < e36452d5da6325df7c10cffc60a9e68d21e2606daffected
LinuxLinux88fd9e5352fe05f7fe57778293aebd4cd106960b < 32c4559c61652f24c9fdd5440342196fe37453bcaffected
LinuxLinux88fd9e5352fe05f7fe57778293aebd4cd106960b < 4f8897bcc20b9ae44758e0572538d741ab66f0dcaffected
LinuxLinux88fd9e5352fe05f7fe57778293aebd4cd106960b < a2aa95b71c9bbec793b5c5fa50f0a80d882b3e8daffected
LinuxLinux5.7affected
LinuxLinux0 < 5.7unaffected
LinuxLinux5.10.120 <= 5.10.*unaffected
LinuxLinux5.15.45 <= 5.15.*unaffected
LinuxLinux5.17.13 <= 5.17.*unaffected
LinuxLinux5.18.2 <= 5.18.*unaffected
LinuxLinux5.19 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References