PT-2022-4895 · Linux · Linux Kernel Bpf

Yifei Zhu · Published 2022-08-10 · Updated 2022-09-26 · CVE-2022-2785

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux Kernel BPF (affected versions not specified)

Description The issue is related to an arbitrary memory read within the Linux Kernel BPF. Constants provided to fill pointers in structs passed to bpf sys bpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAP BPF can arbitrarily read memory from anywhere on the system.

Recommendations To resolve the issue, upgrade past commit 86f44fcec22c. As a temporary workaround, consider restricting the use of the bpf sys bpf function until a patch is available. Restrict access to the BPF subsystem to minimize the risk of exploitation.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

AZL-11015

AZL-34860

BDU:2022-06056

CVE-2022-2785

Affected Products

Linux Kernel Bpf

References · 18

• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2785 · Vendor Advisory
• https://git.kernel.org/bpf/bpf/c/86f44fcec22c · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2785 · Vendor Advisory
• https://lore.kernel.org/bpf/20220816205517.682470-1-zhuyifei%40google.com/T/#t · Vendor Advisory
• https://osv.dev/vulnerability/AZL-11015 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-34860 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-2785 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2785 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2785 · Security Note
• https://bdu.fstec.ru/vul/2022-06056 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-2785 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-2785 · Vendor Advisory
• https://lore.kernel.org/bpf/[e-mail]/T/#t · Note
• https://github.com/advisories/GHSA-xhpr-rjf3-gg6p · Note
• https://t.me/cvenotify/36752 · Telegram Post