CVE-2022-49873

MEDIUM EPSS 7.3%
Published May 1, 20251y ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published May 1, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix wrong reg type conversion in release_reference() Some helper functions will allocate memory. To avoid memory leaks, the verifier requires the eBPF program to release these memories by calling the corresponding helper functions. When a resource is released, all pointer registers corresponding to the resource should be invalidated. The verifier use release_references() to do this job, by apply __mark_reg_unknown() to each relevant register. It will give these registers the type of SCALAR_VALUE. A register that will contain a pointer value at runtime, but of type SCALAR_VALUE, which may allow the unprivileged user to get a kernel pointer by storing this register into a map. Using __mark_reg_not_init() while NOT allow_ptr_leaks can mitigate this problem.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
7.3% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-704

Affected Products 7

VendorProductVersionRange
linuxlinux_kernel*≥4.20  –  <5.10.155
linuxlinux_kernel*≥5.11  –  <5.15.79
linuxlinux_kernel*≥5.16  –  <6.0.9
linuxlinux_kernel6.1any
linuxlinux_kernel6.1any
linuxlinux_kernel6.1any
linuxlinux_kernel6.1any

References 4

  • git.kernel.org https://git.kernel.org/stable/c/466ce46f251dfb259a8cbaa895ab9edd6fb56240
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ae5ccad6c711db0f2ca1231be051935dd128b8f5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cedd4f01f67be94735f15123158f485028571037
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f1db20814af532f85e091231223e5e4818e8464b
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/466ce46f251dfb259a8cbaa895ab9edd6fb56240
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ae5ccad6c711db0f2ca1231be051935dd128b8f5
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/cedd4f01f67be94735f15123158f485028571037
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/f1db20814af532f85e091231223e5e4818e8464b
    Patch