CVE-2022-48940

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix crash due to incorrect copy_map_value

When both bpf_spin_lock and bpf_timer are present in a BPF map value,

copy_map_value needs to skirt both objects when copying a value into and

out of the map. However, the current code does not set both s_off and

t_off in copy_map_value, which leads to a crash when e.g. bpf_spin_lock

is placed in map value with bpf_timer, as bpf_map_update_elem call will

be able to overwrite the other timer object.

When the issue is not fixed, an overwriting can produce the following

splat:

[root@(none) bpf]# ./test_progs -t timer_crash

[ 15.930339] bpf_testmod: loading out-of-tree module taints kernel.

[ 16.037849] ==================================================================

[ 16.038458] BUG: KASAN: user-memory-access in __pv_queued_spin_lock_slowpath+0x32b/0x520

[ 16.038944] Write of size 8 at addr 0000000000043ec0 by task test_progs/325

[ 16.039399]

[ 16.039514] CP

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References