CVE-2022-49961

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO

Precision markers need to be propagated whenever we have an ARG_CONST_*

style argument, as the verifier cannot consider imprecise scalars to be

equivalent for the purposes of states_equal check when such arguments

refine the return value (in this case, set mem_size for PTR_TO_MEM). The

resultant mem_size for the R0 is derived from the constant value, and if

the verifier incorrectly prunes states considering them equivalent where

such arguments exist (by seeing that both registers have reg->precise as

false in regsafe), we can end up with invalid programs passing the

verifier which can do access beyond what should have been the correct

mem_size in that explored state.

To show a concrete example of the problem:

0000000000000000 <prog>:

0: r2 = *(u32 *)(r1 + 80)

1: r1 = *(u32 *)(r1 + 76)

2: r3 = r1

3: r3 +

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References