UBUNTU-CVE-2022-49180

In the Linux kernel, the following vulnerability has been resolved: LSM: general protection fault in legacyparseparam The usual LSM hook "bail on fail" scheme doesn't work for cases where a security module may return an error code indicating that it does not recognize an input. In this particular...

UBUNTU-CVE-2022-49205

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix double uncharge the mem of skmsg If tcpbpfsendmsg is running during a tear down operation, psock may be freed. tcpbpfsendmsg tcpbpfsendverdict skmsgreturn tcpbpfsendmsgredir unlikely!psock skmsgfree The mem of m...

UBUNTU-CVE-2022-49207

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix memleak in skpsockqueuemsg If tcpbpfsendmsg is running during a tear down operation we may enqueue data on the ingress msg queue while tear down is trying to free it. sk1 redirect sk2 sk2 -------------------...

UBUNTU-CVE-2022-49209

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix memleak in tcpbpfsendmsg while sk msg is full If tcpbpfsendmsg is running while sk msg is full. When skmsgalloc returns -ENOMEM error, tcpbpfsendmsg goes to waitformemory. If partial memory has been alloced by...

CVE-2022-49697 bpf: Fix request_sock leak in sk lookup helpers

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix requestsock leak in sk lookup helpers A customer reported a requestsocket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was findin...

CVE-2022-49697

CVE-2022-49697 concerns a leak in the Linux kernel caused by a BPF lookup path that could leak a request_sock. The issue occurs when a BPF program performs a socket lookup that takes a refcnt on the socket and, after locating the child request_socket, returns the parent LISTEN socket via sk_to_fu...

CVE-2022-49697 bpf: Fix request_sock leak in sk lookup helpers

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix requestsock leak in sk lookup helpers A customer reported a requestsocket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was findin...

CVE-2022-49697

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix requestsock leak in sk lookup helpers A customer reported a requestsocket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a refcnt on the socket and that it was findin...

CVE-2022-49658

CVE-2022-49658 concerns the Linux kernel’s BPF bounds propagation. The issue stems from insufficient propagation of tnum min/max bounds into register bounds during operations like adjust_scalar_min_max_vals, allowing a register that becomes a constant-like value to leak pointers when it is later ...

CVE-2022-49658 bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insufficient bounds propagation from adjustscalarminmaxvals Kuee reported a corner case where the tnum becomes constant after the call to regboundoffset, but the register's bounds are not, that is, its min bounds are sti...

CVE-2022-49552 bpf: Fix combination of jit blinding and pointers to bpf subprogs.

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix combination of jit blinding and pointers to bpf subprogs. The combination of jit blinding and pointers to bpf subprogs causes: 36.989548 BUG: unable to handle page fault for address: 0000000100000001 36.990342 PF:...

CVE-2022-49552

CVE-2022-49552 affects the Linux kernel. The issue arises in the BPF JIT blinding logic where ld_imm64 addresses to subprogs are misidentified as normal instructions, causing a page fault in kernel mode. The root cause is the two-phase JIT process for subprogs; the first phase blinds and the seco...

CVE-2022-49552

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix combination of jit blinding and pointers to bpf subprogs. The combination of jit blinding and pointers to bpf subprogs causes: 36.989548 BUG: unable to handle page fault for address: 0000000100000001 36.990342 PF:...

CVE-2022-49548 bpf: Fix potential array overflow in bpf_trampoline_get_progs()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential array overflow in bpftrampolinegetprogs The cnt value in the 'cnt = BPFMAXTRAMPPROGS' check does not include BPFTRAMPMODIFYRETURN bpf programs, so the number of the attached BPFTRAMPMODIFYRETURN bpf programs in...

CVE-2022-49548 bpf: Fix potential array overflow in bpf_trampoline_get_progs()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential array overflow in bpftrampolinegetprogs The cnt value in the 'cnt = BPFMAXTRAMPPROGS' check does not include BPFTRAMPMODIFYRETURN bpf programs, so the number of the attached BPFTRAMPMODIFYRETURN bpf programs in...

CVE-2022-49548

CVE-2022-49548 concerns a Linux kernel BPF trampoline fix. The vulnerability arises from an overflow risk in bpf_trampoline_get_progs(): the cnt check for BPF_MAX_TRAMP_PROGS did not count BPF_TRAMP_MODIFY_RETURN programs, permitting more than the maximum number of trampoline programs to be attac...

CVE-2022-49548 bpf: Fix potential array overflow in bpf_trampoline_get_progs()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential array overflow in bpftrampolinegetprogs The cnt value in the 'cnt = BPFMAXTRAMPPROGS' check does not include BPFTRAMPMODIFYRETURN bpf programs, so the number of the attached BPFTRAMPMODIFYRETURN bpf programs in...

CVE-2022-49548

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix potential array overflow in bpftrampolinegetprogs The cnt value in the 'cnt = BPFMAXTRAMPPROGS' check does not include BPFTRAMPMODIFYRETURN bpf programs, so the number of the attached BPFTRAMPMODIFYRETURN bpf programs in...

CVE-2022-49341 bpf, arm64: Clear prog->jited_len along prog->jited

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog-jitedlen along prog-jited syzbot reported an illegal copytouser attempt from bpfproggetinfobyfd 1 There was no repro yet on this bug, but I think that commit 0aef499f3172 "mm/usercopy: Detect vmalloc...

CVE-2022-49341 bpf, arm64: Clear prog->jited_len along prog->jited

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Clear prog-jitedlen along prog-jited syzbot reported an illegal copytouser attempt from bpfproggetinfobyfd 1 There was no repro yet on this bug, but I think that commit 0aef499f3172 "mm/usercopy: Detect vmalloc...