DEBIAN-CVE-2022-49341

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog-jitedlen along prog-jited syzbot reported an illegal copytouser attempt from bpfproggetinfobyfd 1 There was no repro yet on this bug, but I think that commit 0aef499f3172 "mm/usercopy: Detect vmalloc...

CVE-2022-49236

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to race between btftrygetmodule and loadmodule While working on code to populate kfunc BTF ID sets for module BTF from its initcall, I noticed that by the time the initcall is invoked, the module BTF can already ...

UBUNTU-CVE-2022-49341

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog-jitedlen along prog-jited syzbot reported an illegal copytouser attempt from bpfproggetinfobyfd 1 There was no repro yet on this bug, but I think that commit 0aef499f3172 "mm/usercopy: Detect vmalloc...

UBUNTU-CVE-2022-49552

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix combination of jit blinding and pointers to bpf subprogs. The combination of jit blinding and pointers to bpf subprogs causes: 36.989548 BUG: unable to handle page fault for address: 0000000100000001 36.990342 PF:...

CVE-2022-49209

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix memleak in tcpbpfsendmsg while sk msg is full If tcpbpfsendmsg is running while sk msg is full. When skmsgalloc returns -ENOMEM error, tcpbpfsendmsg goes to waitformemory. If partial memory has been alloced by...

DEBIAN-CVE-2022-49209

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix memleak in tcpbpfsendmsg while sk msg is full If tcpbpfsendmsg is running while sk msg is full. When skmsgalloc returns -ENOMEM error, tcpbpfsendmsg goes to waitformemory. If partial memory has been alloced by...

CVE-2022-49204

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix more uncharged while msg has moredata In tcpbpfsendverdict, if msg has more data after tcpbpfsendmsgredir: tcpbpfsendverdict tosend = msg-sg.size //msg-sg.size = 22220 case SKREDIRECT: skmsgreturn //uncharged...

DEBIAN-CVE-2022-49205

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix double uncharge the mem of skmsg If tcpbpfsendmsg is running during a tear down operation, psock may be freed. tcpbpfsendmsg tcpbpfsendverdict skmsgreturn tcpbpfsendmsgredir unlikely!psock skmsgfree The mem of m...

DEBIAN-CVE-2022-49180

In the Linux kernel, the following vulnerability has been resolved: LSM: general protection fault in legacyparseparam The usual LSM hook "bail on fail" scheme doesn't work for cases where a security module may return an error code indicating that it does not recognize an input. In this particular...

UBUNTU-CVE-2022-49209

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix memleak in tcpbpfsendmsg while sk msg is full If tcpbpfsendmsg is running while sk msg is full. When skmsgalloc returns -ENOMEM error, tcpbpfsendmsg goes to waitformemory. If partial memory has been alloced by...

UBUNTU-CVE-2022-49207

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix memleak in skpsockqueuemsg If tcpbpfsendmsg is running during a tear down operation we may enqueue data on the ingress msg queue while tear down is trying to free it. sk1 redirect sk2 sk2 -------------------...

UBUNTU-CVE-2022-49228

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a btf decltag bug when tagging a function syzbot reported a btf decltag bug with stack trace below: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 1 PREEMPT SMP KASAN KASAN:...

UBUNTU-CVE-2022-49180

In the Linux kernel, the following vulnerability has been resolved: LSM: general protection fault in legacyparseparam The usual LSM hook "bail on fail" scheme doesn't work for cases where a security module may return an error code indicating that it does not recognize an input. In this particular...

UBUNTU-CVE-2022-49205

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix double uncharge the mem of skmsg If tcpbpfsendmsg is running during a tear down operation, psock may be freed. tcpbpfsendmsg tcpbpfsendverdict skmsgreturn tcpbpfsendmsgredir unlikely!psock skmsgfree The mem of m...

CVE-2022-49697

CVE-2022-49697 concerns a leak in the Linux kernel caused by a BPF lookup path that could leak a request_sock. The issue occurs when a BPF program performs a socket lookup that takes a refcnt on the socket and, after locating the child request_socket, returns the parent LISTEN socket via sk_to_fu...

CVE-2022-49697 bpf: Fix request_sock leak in sk lookup helpers

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix requestsock leak in sk lookup helpers A customer reported a requestsocket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was findin...

CVE-2022-49697

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix requestsock leak in sk lookup helpers A customer reported a requestsocket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was findin...

CVE-2022-49697 bpf: Fix request_sock leak in sk lookup helpers

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix requestsock leak in sk lookup helpers A customer reported a requestsocket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was findin...

CVE-2022-49658

CVE-2022-49658 concerns the Linux kernel’s BPF bounds propagation. The issue stems from insufficient propagation of tnum min/max bounds into register bounds during operations like adjust_scalar_min_max_vals, allowing a register that becomes a constant-like value to leak pointers when it is later ...

CVE-2022-49658 bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insufficient bounds propagation from adjustscalarminmaxvals Kuee reported a corner case where the tnum becomes constant after the call to regboundoffset, but the register's bounds are not, that is, its min bounds are sti...