CVE-2022-48929 (GCVE-0-2022-48929)

Vulnerability from cvelistv5 – Published: 2024-08-22 03:31 – Updated: 2026-05-11 18:49
VLAI
Title
bpf: Fix crash due to out of bounds access into reg2btf_ids.
Summary
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix crash due to out of bounds access into reg2btf_ids. When commit e6ac2450d6de ("bpf: Support bpf program calling kernel function") added kfunc support, it defined reg2btf_ids as a cheap way to translate the verifier reg type to the appropriate btf_vmlinux BTF ID, however commit c25b2ae13603 ("bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL") moved the __BPF_REG_TYPE_MAX from the last member of bpf_reg_type enum to after the base register types, and defined other variants using type flag composition. However, now, the direct usage of reg->type to index into reg2btf_ids may no longer fall into __BPF_REG_TYPE_MAX range, and hence lead to out of bounds access and kernel crash on dereference of bad pointer.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 8d38cde47a7e17b646401fa92d916503caa5375e , < 8c39925e98d498b9531343066ef82ae39e41adae (git)
Affected: 77459bc4d5e2c6f24db845780b4d9d60cf82d06a , < f0ce1bc9e0235dd7412240be493d7ea65ed9eadc (git)
Affected: c25b2ae136039ffa820c26138ed4a5e5f3ab3841 , < 45ce4b4f9009102cd9f581196d480a59208690c1 (git)
Create a notification for this product.
Linux Linux Affected: 5.16.11 , < 5.16.12 (semver)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48929",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:32:56.249126Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:33:00.206Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/btf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c39925e98d498b9531343066ef82ae39e41adae",
              "status": "affected",
              "version": "8d38cde47a7e17b646401fa92d916503caa5375e",
              "versionType": "git"
            },
            {
              "lessThan": "f0ce1bc9e0235dd7412240be493d7ea65ed9eadc",
              "status": "affected",
              "version": "77459bc4d5e2c6f24db845780b4d9d60cf82d06a",
              "versionType": "git"
            },
            {
              "lessThan": "45ce4b4f9009102cd9f581196d480a59208690c1",
              "status": "affected",
              "version": "c25b2ae136039ffa820c26138ed4a5e5f3ab3841",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/bpf/btf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5.16.12",
              "status": "affected",
              "version": "5.16.11",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.12",
                  "versionStartIncluding": "5.16.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix crash due to out of bounds access into reg2btf_ids.\n\nWhen commit e6ac2450d6de (\"bpf: Support bpf program calling kernel function\") added\nkfunc support, it defined reg2btf_ids as a cheap way to translate the verifier\nreg type to the appropriate btf_vmlinux BTF ID, however\ncommit c25b2ae13603 (\"bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL\")\nmoved the __BPF_REG_TYPE_MAX from the last member of bpf_reg_type enum to after\nthe base register types, and defined other variants using type flag\ncomposition. However, now, the direct usage of reg-\u003etype to index into\nreg2btf_ids may no longer fall into __BPF_REG_TYPE_MAX range, and hence lead to\nout of bounds access and kernel crash on dereference of bad pointer."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:49:52.882Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c39925e98d498b9531343066ef82ae39e41adae"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0ce1bc9e0235dd7412240be493d7ea65ed9eadc"
        },
        {
          "url": "https://git.kernel.org/stable/c/45ce4b4f9009102cd9f581196d480a59208690c1"
        }
      ],
      "title": "bpf: Fix crash due to out of bounds access into reg2btf_ids.",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48929",
    "datePublished": "2024-08-22T03:31:22.329Z",
    "dateReserved": "2024-08-21T06:06:23.298Z",
    "dateUpdated": "2026-05-11T18:49:52.882Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48929",
      "date": "2026-05-26",
      "epss": "0.00028",
      "percentile": "0.082"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.15.15\", \"versionEndExcluding\": \"5.15.37\", \"matchCriteriaId\": \"BEB734DF-768A-48DC-8983-4ED1A0CA1A3D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16.1\", \"versionEndExcluding\": \"5.16.12\", \"matchCriteriaId\": \"4368C931-8568-4F36-A74D-8E41781257A6\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix crash due to out of bounds access into reg2btf_ids.\\n\\nWhen commit e6ac2450d6de (\\\"bpf: Support bpf program calling kernel function\\\") added\\nkfunc support, it defined reg2btf_ids as a cheap way to translate the verifier\\nreg type to the appropriate btf_vmlinux BTF ID, however\\ncommit c25b2ae13603 (\\\"bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL\\\")\\nmoved the __BPF_REG_TYPE_MAX from the last member of bpf_reg_type enum to after\\nthe base register types, and defined other variants using type flag\\ncomposition. However, now, the direct usage of reg-\u003etype to index into\\nreg2btf_ids may no longer fall into __BPF_REG_TYPE_MAX range, and hence lead to\\nout of bounds access and kernel crash on dereference of bad pointer.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se resolvi\\u00f3 la siguiente vulnerabilidad: bpf: Se corrigi\\u00f3 el bloqueo debido al acceso fuera de los l\\u00edmites a reg2btf_ids. Cuando el commit e6ac2450d6de (\\\"bpf: admite la funci\\u00f3n del kernel que llama al programa bpf\\\") agreg\\u00f3 soporte para kfunc, defini\\u00f3 reg2btf_ids como una forma econ\\u00f3mica de traducir el tipo de registro del verificador al ID de BTF btf_vmlinux apropiado; sin embargo, commit c25b2ae13603 (\\\"bpf: reemplace PTR_TO_XXX_OR_NULL con PTR_TO_XXX | PTR_MAYBE_NULL\\\") movi\\u00f3 __BPF_REG_TYPE_MAX del \\u00faltimo miembro de la enumeraci\\u00f3n bpf_reg_type a despu\\u00e9s de los tipos de registro base y defini\\u00f3 otras variantes utilizando la composici\\u00f3n de indicadores de tipo. Sin embargo, ahora, el uso directo de reg-\u0026gt;type para indexar en reg2btf_ids ya no puede caer en el rango __BPF_REG_TYPE_MAX y, por lo tanto, provocar un acceso fuera de los l\\u00edmites y un bloqueo del kernel al desreferenciar un puntero incorrecto.\"}]",
      "id": "CVE-2022-48929",
      "lastModified": "2024-08-23T02:00:22.653",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-08-22T04:15:15.773",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/45ce4b4f9009102cd9f581196d480a59208690c1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8c39925e98d498b9531343066ef82ae39e41adae\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/f0ce1bc9e0235dd7412240be493d7ea65ed9eadc\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-125\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48929\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-22T04:15:15.773\",\"lastModified\":\"2024-08-23T02:00:22.653\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix crash due to out of bounds access into reg2btf_ids.\\n\\nWhen commit e6ac2450d6de (\\\"bpf: Support bpf program calling kernel function\\\") added\\nkfunc support, it defined reg2btf_ids as a cheap way to translate the verifier\\nreg type to the appropriate btf_vmlinux BTF ID, however\\ncommit c25b2ae13603 (\\\"bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL\\\")\\nmoved the __BPF_REG_TYPE_MAX from the last member of bpf_reg_type enum to after\\nthe base register types, and defined other variants using type flag\\ncomposition. However, now, the direct usage of reg-\u003etype to index into\\nreg2btf_ids may no longer fall into __BPF_REG_TYPE_MAX range, and hence lead to\\nout of bounds access and kernel crash on dereference of bad pointer.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: bpf: Se corrigi\u00f3 el bloqueo debido al acceso fuera de los l\u00edmites a reg2btf_ids. Cuando el commit e6ac2450d6de (\\\"bpf: admite la funci\u00f3n del kernel que llama al programa bpf\\\") agreg\u00f3 soporte para kfunc, defini\u00f3 reg2btf_ids como una forma econ\u00f3mica de traducir el tipo de registro del verificador al ID de BTF btf_vmlinux apropiado; sin embargo, commit c25b2ae13603 (\\\"bpf: reemplace PTR_TO_XXX_OR_NULL con PTR_TO_XXX | PTR_MAYBE_NULL\\\") movi\u00f3 __BPF_REG_TYPE_MAX del \u00faltimo miembro de la enumeraci\u00f3n bpf_reg_type a despu\u00e9s de los tipos de registro base y defini\u00f3 otras variantes utilizando la composici\u00f3n de indicadores de tipo. Sin embargo, ahora, el uso directo de reg-\u0026gt;type para indexar en reg2btf_ids ya no puede caer en el rango __BPF_REG_TYPE_MAX y, por lo tanto, provocar un acceso fuera de los l\u00edmites y un bloqueo del kernel al desreferenciar un puntero incorrecto.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.15\",\"versionEndExcluding\":\"5.15.37\",\"matchCriteriaId\":\"BEB734DF-768A-48DC-8983-4ED1A0CA1A3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16.1\",\"versionEndExcluding\":\"5.16.12\",\"matchCriteriaId\":\"4368C931-8568-4F36-A74D-8E41781257A6\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/45ce4b4f9009102cd9f581196d480a59208690c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8c39925e98d498b9531343066ef82ae39e41adae\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f0ce1bc9e0235dd7412240be493d7ea65ed9eadc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48929\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T15:32:56.249126Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:12.658Z\"}}], \"cna\": {\"title\": \"bpf: Fix crash due to out of bounds access into reg2btf_ids.\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8d38cde47a7e17b646401fa92d916503caa5375e\", \"lessThan\": \"8c39925e98d498b9531343066ef82ae39e41adae\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"77459bc4d5e2c6f24db845780b4d9d60cf82d06a\", \"lessThan\": \"f0ce1bc9e0235dd7412240be493d7ea65ed9eadc\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"c25b2ae136039ffa820c26138ed4a5e5f3ab3841\", \"lessThan\": \"45ce4b4f9009102cd9f581196d480a59208690c1\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/bpf/btf.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.16.11\", \"lessThan\": \"5.16.12\", \"versionType\": \"semver\"}], \"programFiles\": [\"kernel/bpf/btf.c\"], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/8c39925e98d498b9531343066ef82ae39e41adae\"}, {\"url\": \"https://git.kernel.org/stable/c/f0ce1bc9e0235dd7412240be493d7ea65ed9eadc\"}, {\"url\": \"https://git.kernel.org/stable/c/45ce4b4f9009102cd9f581196d480a59208690c1\"}], \"x_generator\": {\"engine\": \"bippy-5f407fcff5a0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbpf: Fix crash due to out of bounds access into reg2btf_ids.\\n\\nWhen commit e6ac2450d6de (\\\"bpf: Support bpf program calling kernel function\\\") added\\nkfunc support, it defined reg2btf_ids as a cheap way to translate the verifier\\nreg type to the appropriate btf_vmlinux BTF ID, however\\ncommit c25b2ae13603 (\\\"bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL\\\")\\nmoved the __BPF_REG_TYPE_MAX from the last member of bpf_reg_type enum to after\\nthe base register types, and defined other variants using type flag\\ncomposition. However, now, the direct usage of reg-\u003etype to index into\\nreg2btf_ids may no longer fall into __BPF_REG_TYPE_MAX range, and hence lead to\\nout of bounds access and kernel crash on dereference of bad pointer.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-12-27T12:16:47.414Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48929\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-27T12:16:47.414Z\", \"dateReserved\": \"2024-08-21T06:06:23.298Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-22T03:31:22.329Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.