mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-07-29 05:56:17 +00:00
41 lines
3.3 KiB
JSON
41 lines
3.3 KiB
JSON
{
|
|
"id": "CVE-2022-50219",
|
|
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"published": "2025-06-18T11:15:52.863",
|
|
"lastModified": "2025-06-18T13:47:40.833",
|
|
"vulnStatus": "Awaiting Analysis",
|
|
"cveTags": [],
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix KASAN use-after-free Read in compute_effective_progs\n\nSyzbot found a Use After Free bug in compute_effective_progs().\nThe reproducer creates a number of BPF links, and causes a fault\ninjected alloc to fail, while calling bpf_link_detach on them.\nLink detach triggers the link to be freed by bpf_link_free(),\nwhich calls __cgroup_bpf_detach() and update_effective_progs().\nIf the memory allocation in this function fails, the function restores\nthe pointer to the bpf_cgroup_link on the cgroup list, but the memory\ngets freed just after it returns. After this, every subsequent call to\nupdate_effective_progs() causes this already deallocated pointer to be\ndereferenced in prog_list_length(), and triggers KASAN UAF error.\n\nTo fix this issue don't preserve the pointer to the prog or link in the\nlist, but remove it and replace it with a dummy prog without shrinking\nthe table. The subsequent call to __cgroup_bpf_detach() or\n__cgroup_bpf_detach() will correct it."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: Correcci\u00f3n de la lectura de Use-After-Free de KASAN en compute_effective_progs Syzbot encontr\u00f3 un error de Use-After-Free en compute_effective_progs(). El reproductor crea varios enlaces BPF y provoca que falle una asignaci\u00f3n inyectada por error, al llamar a bpf_link_detach en ellos. La separaci\u00f3n del enlace activa la liberaci\u00f3n del enlace por bpf_link_free(), que llama a __cgroup_bpf_detach() y update_effective_progs(). Si la asignaci\u00f3n de memoria en esta funci\u00f3n falla, la funci\u00f3n restaura el puntero a bpf_cgroup_link en la lista cgroup, pero la memoria se libera justo despu\u00e9s de que regrese. Despu\u00e9s de esto, cada llamada posterior a update_effective_progs() hace que este puntero ya desasignado se desreferencia en prog_list_length() y activa el error UAF de KASAN. Para solucionar este problema, no conserve el puntero al programa ni al enlace en la lista, sino elim\u00ednelo y reempl\u00e1celo con un programa ficticio sin reducir la tabla. La llamada posterior a __cgroup_bpf_detach() o __cgroup_bpf_detach() lo corregir\u00e1. "
|
|
}
|
|
],
|
|
"metrics": {},
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/1f8ca9c40e6222ce431e9ba5dae3cccce8ef9443",
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/3527e3cbb84d8868c4d4e91ba55915f96d39ec3d",
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/4c46091ee985ae84c60c5e95055d779fcd291d87",
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/6336388715afa419cc97d0255bda3bba1b96b7ca",
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/be001f9da71eaa3b61e186fb88bde3279728bdca",
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
|
}
|
|
]
|
|
} |