CVE-2022-2905

Published: 9 September 2022

An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data.

From the Ubuntu Security Team

Hsin-Wei Hung discovered that the BPF subsystem in the Linux kernel contained an out-of-bounds read vulnerability in the x86 JIT compiler. A local attacker could possibly use this to cause a denial of service (system crash) or expose sensitive information (kernel memory).

Notes

unprivileged BPF is disabled by default in Ubuntu
kernels; thus administrative privileges are required to exploit
this unless a non-default configuration is used where the
kernel.unprivileged_bpf_disabled sysctl has been set to 0.

Mitigation

Ensure the kernel.unprivileged_bpf_disabled sysctl is set to 2 (the
default) or 1.

Status

Severity score breakdown

References

• https://www.openwall.com/lists/oss-security/2022/08/26/1
• https://ubuntu.com/security/notices/USN-5729-1
• https://ubuntu.com/security/notices/USN-5729-2
• https://www.cve.org/CVERecord?id=CVE-2022-2905
• NVD
• Launchpad
• Debian