PT-2025-18590 · Linux+2 · Linux Kernel+2

Published 2023-11-07 · Updated 2025-05-02 · CVE-2022-49873

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue concerns a problem in the Linux kernel's bpf (Berkeley Packet Filter) where a wrong type conversion in the release reference() function can lead to potential memory leaks. Helper functions may allocate memory, and to prevent leaks, the eBPF program must release this memory by calling corresponding helper functions. When a resource is released, all relevant pointer registers should be invalidated to prevent potential exploitation. The verifier uses release references() to apply mark reg unknown() to each relevant register, marking them as SCALAR VALUE. However, a register with a SCALAR VALUE type that contains a pointer value at runtime could allow an unprivileged user to obtain a kernel pointer by storing the register in a map. Using mark reg not init() while not allowing pointer leaks can mitigate this problem.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-704

Related Identifiers

CVE-2022-49873

RHSA-2023:6583

RHSA-2023_6583

Affected Products

Astra Linux

Linux Kernel

Red Hat

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49873.json · Exploit
• https://ubuntu.com/security/CVE-2022-49873 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49873 · Vendor Advisory
• https://git.kernel.org/stable/c/ae5ccad6c711db0f2ca1231be051935dd128b8f5 · Patch
• https://osv.dev/vulnerability/CVE-2022-49873 · Vendor Advisory
• https://git.kernel.org/stable/c/f1db20814af532f85e091231223e5e4818e8464b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49873 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-49873 · Security Note
• https://git.kernel.org/stable/c/466ce46f251dfb259a8cbaa895ab9edd6fb56240 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-49873 · Vendor Advisory
• https://git.kernel.org/stable/c/cedd4f01f67be94735f15123158f485028571037 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49873 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEnew/status/1917950847818019137 · Twitter Post
• https://git.kernel.org/linus/f1db20814af532f85e091231223e5e4818e8464b · Note