CVE-2022-49341
published 2025-02-26CVE-2022-49341: In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog->jited_len along prog->jited syzbot reported an illegal…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.28%
20.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Clear prog->jited_len along prog->jited
syzbot reported an illegal copy_to_user() attempt
from bpf_prog_get_info_by_fd() [1]
There was no repro yet on this bug, but I think
that commit 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns")
is exposing a prior bug in bpf arm64.
bpf_prog_get_info_by_fd() looks at prog->jited_len
to determine if the JIT image can be copied out to user space.
My theory is that syzbot managed to get a prog where prog->jited_len
has been set to 43, while prog->bpf_func has ben cleared.
It is not clear why copy_to_user(uinsns, NULL, ulen) is triggering
this particular warning.
I thought find_vma_area(NULL) would not find a vm_struct.
As we do not hold vmap_area_lock spinlock, it might be possible
that the found vm_struct was garbage.
[1]
usercopy: Kernel memory exposure attempt detected from vmalloc (offset 792633534417210172, size 43)!
kernel BUG at mm/usercopy.c:101!
Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 25002 Comm: syz-executor.1 Not tainted 5.18.0-syzkaller-10139-g8291eaafed36 #0
Hardware name: linux,dummy-virt (DT)
pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : usercopy_abort+0x90/0x94 mm/usercopy.c:101
lr : usercopy_abort+0x90/0x94 mm/usercopy.c:89
sp : ffff80000b773a20
x29: ffff80000b773a30 x28: faff80000b745000 x27: ffff80000b773b48
x26: 0000000000000000 x25: 000000000000002b x24: 0000000000000000
x23: 00000000000000e0 x22: ffff80000b75db67 x21: 0000000000000001
x20: 000000000000002b x19: ffff80000b75db3c x18: 00000000fffffffd
x17: 2820636f6c6c616d x16: 76206d6f72662064 x15: 6574636574656420
x14: 74706d6574746120 x13: 2129333420657a69 x12: 73202c3237313031
x11: 3237313434333533 x10: 3336323937207465 x9 : 657275736f707865
x8 : ffff80000a30c550 x7 : ffff80000b773830 x6 : ffff80000b773830
x5 : 0000000000000000 x4 : ffff00007fbbaa10 x3 : 0000000000000000
x2 : 0000000000000000 x1 : f7ff0000
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.18.5-1 (bookworm) | linux 5.18.5-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= db496944fdaaf2a67d2f60529f5dc23abf809506 < aaf61a312af63e1cfe2264c4c5b8cd4ea3626025 | aaf61a312af63e1cfe2264c4c5b8cd4ea3626025 |
| linux | linux | >= db496944fdaaf2a67d2f60529f5dc23abf809506 < e412b3d178ea4bf746f6b8ee086761613704c6be | e412b3d178ea4bf746f6b8ee086761613704c6be |
| linux | linux | >= db496944fdaaf2a67d2f60529f5dc23abf809506 < 0cf7aaff290cdc4d7cee683d4a18138b0dacac48 | 0cf7aaff290cdc4d7cee683d4a18138b0dacac48 |
| linux | linux | >= db496944fdaaf2a67d2f60529f5dc23abf809506 < 3f4d5e727aeaa610688d46c9f101f78b7f712583 | 3f4d5e727aeaa610688d46c9f101f78b7f712583 |
| linux | linux | >= db496944fdaaf2a67d2f60529f5dc23abf809506 < 5c25a3040bc0486c41a7b63a1fb0de7cdb846ad7 | 5c25a3040bc0486c41a7b63a1fb0de7cdb846ad7 |
| linux | linux | >= db496944fdaaf2a67d2f60529f5dc23abf809506 < 41f7c4f85d402043687e863627a1a84fa867c62d | 41f7c4f85d402043687e863627a1a84fa867c62d |
| linux | linux | >= db496944fdaaf2a67d2f60529f5dc23abf809506 < 10f3b29c65bb2fe0d47c2945cd0b4087be1c5218 | 10f3b29c65bb2fe0d47c2945cd0b4087be1c5218 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.127-1 | 5.10.127-1 |
| linux | linux_kernel | >= 0 < 5.18.5-1 | 5.18.5-1 |
| linux | linux_kernel | >= 0 < 5.18.5-1 | 5.18.5-1 |
| linux | linux_kernel | >= 0 < 5.18.5-1 | 5.18.5-1 |
| linux | linux_kernel | >= 4.16 < 4.19.247 | 4.19.247 |
| linux | linux_kernel | >= 4.20 < 5.4.198 | 5.4.198 |
| linux | linux_kernel | >= 5.11 < 5.15.47 | 5.15.47 |
| linux | linux_kernel | >= 5.16 < 5.17.15 | 5.17.15 |
| linux | linux_kernel | >= 5.18 < 5.18.4 | 5.18.4 |
| linux | linux_kernel | >= 5.5 < 5.10.122 | 5.10.122 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2c59-vh4j-7xh2: In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Clear prog->jited_len along prog->jited
syzbot reported an illegal c
ghsa_unreviewed·2025-10-21
CVE-2022-49341 [MEDIUM] GHSA-2c59-vh4j-7xh2: In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Clear prog->jited_len along prog->jited
syzbot reported an illegal c
In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Clear prog->jited_len along prog->jited
syzbot reported an illegal copy_to_user() attempt
from bpf_prog_get_info_by_fd() [1]
There was no repro yet on this bug, but I think
that commit 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns")
is exposing a prior bug in bpf arm64.
bpf_prog_get_info_by_fd() looks at prog->jited_len
to determine if the JIT image can be copied out to user space.
My theory is that syzbot managed to get a prog where prog->jited_len
has been set to 43, while prog->bpf_func has ben cleared.
It is not clear why copy_to_user(uinsns, NULL, ulen) is triggering
this particular warning.
I thought find_vma_area(NULL) would not find a vm_struct.
As we do not hold vmap_area_lock spinlock, it
OSV
CVE-2022-49341: In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog->jited_len along prog->jited syzbot reported an illegal cop
osv·2025-02-26·CVSS 5.5
CVE-2022-49341 [MEDIUM] CVE-2022-49341: In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog->jited_len along prog->jited syzbot reported an illegal cop
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog->jited_len along prog->jited syzbot reported an illegal copy_to_user() attempt from bpf_prog_get_info_by_fd() [1] There was no repro yet on this bug, but I think that commit 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns") is exposing a prior bug in bpf arm64. bpf_prog_get_info_by_fd() looks at prog->jited_len to determine if the JIT image can be copied out to user space. My theory is that syzbot managed to get a prog where prog->jited_len has been set to 43, while prog->bpf_func has ben cleared. It is not clear why copy_to_user(uinsns, NULL, ulen) is triggering this particular warning. I thought find_vma_area(NULL) would not find a vm_struct. As we do not hold vmap_area_lock spinlock, it might
Red Hat
kernel: bpf, arm64: Clear prog->jited_len along prog->jited
vendor_redhat·2025-02-26·CVSS 5.5
CVE-2022-49341 [MEDIUM] kernel: bpf, arm64: Clear prog->jited_len along prog->jited
kernel: bpf, arm64: Clear prog->jited_len along prog->jited
In the Linux kernel, the following vulnerability has been resolved:
bpf, arm64: Clear prog->jited_len along prog->jited
syzbot reported an illegal copy_to_user() attempt
from bpf_prog_get_info_by_fd() [1]
There was no repro yet on this bug, but I think
that commit 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns")
is exposing a prior bug in bpf arm64.
bpf_prog_get_info_by_fd() looks at prog->jited_len
to determine if the JIT image can be copied out to user space.
My theory is that syzbot managed to get a prog where prog->jited_len
has been set to 43, while prog->bpf_func has ben cleared.
It is not clear why copy_to_user(uinsns, NULL, ulen) is triggering
this particular warning.
I thought find_vma_area(NULL) would not find a vm
Debian
CVE-2022-49341: linux - In the Linux kernel, the following vulnerability has been resolved: bpf, arm64:...
vendor_debian·2022·CVSS 5.5
CVE-2022-49341 [MEDIUM] CVE-2022-49341: linux - In the Linux kernel, the following vulnerability has been resolved: bpf, arm64:...
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog->jited_len along prog->jited syzbot reported an illegal copy_to_user() attempt from bpf_prog_get_info_by_fd() [1] There was no repro yet on this bug, but I think that commit 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns") is exposing a prior bug in bpf arm64. bpf_prog_get_info_by_fd() looks at prog->jited_len to determine if the JIT image can be copied out to user space. My theory is that syzbot managed to get a prog where prog->jited_len has been set to 43, while prog->bpf_func has ben cleared. It is not clear why copy_to_user(uinsns, NULL, ulen) is triggering this particular warning. I thought find_vma_area(NULL) would not find a vm_struct. As we do not hold vmap_area_lock spinlock, it might
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0cf7aaff290cdc4d7cee683d4a18138b0dacac48https://git.kernel.org/stable/c/10f3b29c65bb2fe0d47c2945cd0b4087be1c5218https://git.kernel.org/stable/c/3f4d5e727aeaa610688d46c9f101f78b7f712583https://git.kernel.org/stable/c/41f7c4f85d402043687e863627a1a84fa867c62dhttps://git.kernel.org/stable/c/5c25a3040bc0486c41a7b63a1fb0de7cdb846ad7https://git.kernel.org/stable/c/aaf61a312af63e1cfe2264c4c5b8cd4ea3626025https://git.kernel.org/stable/c/e412b3d178ea4bf746f6b8ee086761613704c6be
2025-02-26
Published