CVE-2022-48770 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack() task_pt_regs() can return NULL on powerpc for kernel threads. This is then used in __bpf_get_stack() to check for user mode, resulting in a kernel oops. Guard against this by checking return value of task_pt_regs() before trying to obtain the call chain.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

References

Link	Providers
https://git.kernel.org/stable/c/0bcd484587b3b3092e448d27dc369e347e1810c3
https://git.kernel.org/stable/c/b82ef4985a6d05e80f604624332430351df7b79a
https://git.kernel.org/stable/c/b992f01e66150fc5e90be4a96f5eb8e634c8249e
https://git.kernel.org/stable/c/ff6bdc205fd0a83bd365405d4e31fb5905826996
https://lore.kernel.org/linux-cve-announce/2024062011-CVE-2022-48770-34e0@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-48770
https://www.cve.org/CVERecord?id=CVE-2022-48770

History

Thu, 12 Sep 2024 08:30:00 +0000

Type	Values Removed	Values Added
Metrics	ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 11 Sep 2024 13:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-06-20T11:13:45.193Z

Updated: 2024-09-11T17:34:46.874Z

Reserved: 2024-06-20T11:09:39.061Z

Link: CVE-2022-48770

Vulnrichment

Updated: 2024-08-03T15:25:01.559Z

NVD

Status : Awaiting Analysis

Published: 2024-06-20T12:15:14.953

Modified: 2024-06-20T12:43:25.663

Link: CVE-2022-48770

Redhat

Severity : Low

Publid Date: 2024-06-20T00:00:00Z

Links: CVE-2022-48770 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-48770", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-06-20T11:09:39.061Z", "datePublished": "2024-06-20T11:13:45.193Z", "dateUpdated": "2024-09-11T17:34:46.874Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-06-20T11:15:06.526Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard against accessing NULL pt_regs in bpf_get_task_stack()\n\ntask_pt_regs() can return NULL on powerpc for kernel threads. This is\nthen used in __bpf_get_stack() to check for user mode, resulting in a\nkernel oops. Guard against this by checking return value of\ntask_pt_regs() before trying to obtain the call chain."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/stackmap.c"], "versions": [{"version": "fa28dcb82a38", "lessThan": "ff6bdc205fd0", "status": "affected", "versionType": "git"}, {"version": "fa28dcb82a38", "lessThan": "0bcd484587b3", "status": "affected", "versionType": "git"}, {"version": "fa28dcb82a38", "lessThan": "b82ef4985a6d", "status": "affected", "versionType": "git"}, {"version": "fa28dcb82a38", "lessThan": "b992f01e6615", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/bpf/stackmap.c"], "versions": [{"version": "5.9", "status": "affected"}, {"version": "0", "lessThan": "5.9", "status": "unaffected", "versionType": "custom"}, {"version": "5.10.96", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "custom"}, {"version": "5.15.19", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "custom"}, {"version": "5.16.5", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "custom"}, {"version": "5.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/ff6bdc205fd0a83bd365405d4e31fb5905826996"}, {"url": "https://git.kernel.org/stable/c/0bcd484587b3b3092e448d27dc369e347e1810c3"}, {"url": "https://git.kernel.org/stable/c/b82ef4985a6d05e80f604624332430351df7b79a"}, {"url": "https://git.kernel.org/stable/c/b992f01e66150fc5e90be4a96f5eb8e634c8249e"}], "title": "bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack()", "x_generator": {"engine": "bippy-7d53e8ef8be4"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:01.559Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ff6bdc205fd0a83bd365405d4e31fb5905826996", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0bcd484587b3b3092e448d27dc369e347e1810c3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b82ef4985a6d05e80f604624332430351df7b79a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b992f01e66150fc5e90be4a96f5eb8e634c8249e", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48770", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:10:00.483681Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:34:46.874Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/ff6bdc205fd0a83bd365405d4e31fb5905826996", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/0bcd484587b3b3092e448d27dc369e347e1810c3", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b82ef4985a6d05e80f604624332430351df7b79a", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/b992f01e66150fc5e90be4a96f5eb8e634c8249e", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T15:25:01.559Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48770", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T17:10:00.483681Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:25.871Z"}}], "cna": {"title": "bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "fa28dcb82a38", "lessThan": "ff6bdc205fd0", "versionType": "git"}, {"status": "affected", "version": "fa28dcb82a38", "lessThan": "0bcd484587b3", "versionType": "git"}, {"status": "affected", "version": "fa28dcb82a38", "lessThan": "b82ef4985a6d", "versionType": "git"}, {"status": "affected", "version": "fa28dcb82a38", "lessThan": "b992f01e6615", "versionType": "git"}], "programFiles": ["kernel/bpf/stackmap.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.9"}, {"status": "unaffected", "version": "0", "lessThan": "5.9", "versionType": "custom"}, {"status": "unaffected", "version": "5.10.96", "versionType": "custom", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.19", "versionType": "custom", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16.5", "versionType": "custom", "lessThanOrEqual": "5.16.*"}, {"status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["kernel/bpf/stackmap.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ff6bdc205fd0a83bd365405d4e31fb5905826996"}, {"url": "https://git.kernel.org/stable/c/0bcd484587b3b3092e448d27dc369e347e1810c3"}, {"url": "https://git.kernel.org/stable/c/b82ef4985a6d05e80f604624332430351df7b79a"}, {"url": "https://git.kernel.org/stable/c/b992f01e66150fc5e90be4a96f5eb8e634c8249e"}], "x_generator": {"engine": "bippy-7d53e8ef8be4"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Guard against accessing NULL pt_regs in bpf_get_task_stack()\n\ntask_pt_regs() can return NULL on powerpc for kernel threads. This is\nthen used in __bpf_get_stack() to check for user mode, resulting in a\nkernel oops. Guard against this by checking return value of\ntask_pt_regs() before trying to obtain the call chain."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-06-20T11:15:06.526Z"}}}, "cveMetadata": {"cveId": "CVE-2022-48770", "state": "PUBLISHED", "dateUpdated": "2024-09-11T17:34:46.874Z", "dateReserved": "2024-06-20T11:09:39.061Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-06-20T11:13:45.193Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}