CVE-2022-50168

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, x86: fix freeing of not-finalized bpf_prog_pack

syzbot reported a few issues with bpf_prog_pack [1], [2]. This only happens

with multiple subprogs. In jit_subprogs(), we first call bpf_int_jit_compile()

on each sub program. And then, we call it on each sub program again. jit_data

is not freed in the first call of bpf_int_jit_compile(). Similarly we don't

call bpf_jit_binary_pack_finalize() in the first call of bpf_int_jit_compile().

If bpf_int_jit_compile() failed for one sub program, we will call

bpf_jit_binary_pack_finalize() for this sub program. However, we don't have a

chance to call it for other sub programs. Then we will hit "goto out_free" in

jit_subprogs(), and call bpf_jit_free on some subprograms that haven't got

bpf_jit_binary_pack_finalize() yet.

At this point, bpf_jit_binary_pack_free() is called and the whole 2MB page is

freed erroneously.

Fix this with a custom bpf_jit_free() for x86_64, which

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References