CVE-2022-48940

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-48940
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-48940.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-48940
Downstream
Related
Published
2024-08-22T03:31:35Z
Modified
2025-10-08T07:12:42.310968Z
Summary
bpf: Fix crash due to incorrect copy_map_value
Details

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix crash due to incorrect copymapvalue

When both bpfspinlock and bpftimer are present in a BPF map value, copymapvalue needs to skirt both objects when copying a value into and out of the map. However, the current code does not set both soff and toff in copymapvalue, which leads to a crash when e.g. bpfspinlock is placed in map value with bpftimer, as bpfmapupdate_elem call will be able to overwrite the other timer object.

When the issue is not fixed, an overwriting can produce the following splat:

[root@(none) bpf]# ./testprogs -t timercrash [ 15.930339] bpftestmod: loading out-of-tree module taints kernel. [ 16.037849] ================================================================== [ 16.038458] BUG: KASAN: user-memory-access in _pvqueuedspinlockslowpath+0x32b/0x520 [ 16.038944] Write of size 8 at addr 0000000000043ec0 by task testprogs/325 [ 16.039399] [ 16.039514] CPU: 0 PID: 325 Comm: testprogs Tainted: G OE 5.16.0+ #278 [ 16.039983] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.15.0-1 04/01/2014 [ 16.040485] Call Trace: [ 16.040645] <TASK> [ 16.040805] dumpstacklvl+0x59/0x73 [ 16.041069] ? _pvqueuedspinlockslowpath+0x32b/0x520 [ 16.041427] kasanreport.cold+0x116/0x11b [ 16.041673] ? _pvqueuedspinlockslowpath+0x32b/0x520 [ 16.042040] _pvqueuedspinlockslowpath+0x32b/0x520 [ 16.042328] ? memcpy+0x39/0x60 [ 16.042552] ? pvhash+0xd0/0xd0 [ 16.042785] ? lockdephardirqsoff+0x95/0xd0 [ 16.043079] _bpfspinlockirqsave+0xdf/0xf0 [ 16.043366] ? bpfgetcurrentcomm+0x50/0x50 [ 16.043608] ? jhash+0x11a/0x270 [ 16.043848] bpftimercancel+0x34/0xe0 [ 16.044119] bpfprogc4ea1c0f7449940dsysenter+0x7c/0x81 [ 16.044500] bpftrampoline64424778380+0x36/0x1000 [ 16.044836] _x64sysnanosleep+0x5/0x140 [ 16.045119] dosyscall64+0x59/0x80 [ 16.045377] ? lockisheldtype+0xe4/0x140 [ 16.045670] ? irqentryexittousermode+0xa/0x40 [ 16.046001] ? markheldlocks+0x24/0x90 [ 16.046287] ? asmexcpagefault+0x1e/0x30 [ 16.046569] ? asmexcpagefault+0x8/0x30 [ 16.046851] ? lockdephardirqson+0x7e/0x100 [ 16.047137] entrySYSCALL64afterhwframe+0x44/0xae [ 16.047405] RIP: 0033:0x7f9e4831718d [ 16.047602] Code: b4 0c 00 0f 05 eb a9 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d b3 6c 0c 00 f7 d8 64 89 01 48 [ 16.048764] RSP: 002b:00007fff488086b8 EFLAGS: 00000206 ORIGRAX: 0000000000000023 [ 16.049275] RAX: ffffffffffffffda RBX: 00007f9e48683740 RCX: 00007f9e4831718d [ 16.049747] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff488086d0 [ 16.050225] RBP: 00007fff488086f0 R08: 00007fff488085d7 R09: 00007f9e4cb594a0 [ 16.050648] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f9e484cde30 [ 16.051124] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 16.051608] </TASK> [ 16.051762] ==================================================================

References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
68134668c17f31f51930478f75495b552a411550
Fixed
719d1c2524c89ada78c4c9202641c1d9e942a322
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
68134668c17f31f51930478f75495b552a411550
Fixed
eca9bd215d2233de79d930fa97aefbce03247a98
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
68134668c17f31f51930478f75495b552a411550
Fixed
a8abb0c3dc1e28454851a00f8b7333d9695d566c

Affected versions

v5.*

v5.14
v5.14-rc1
v5.14-rc2
v5.14-rc3
v5.14-rc4
v5.14-rc5
v5.14-rc6
v5.14-rc7
v5.15
v5.15-rc1
v5.15-rc2
v5.15-rc3
v5.15-rc4
v5.15-rc5
v5.15-rc6
v5.15-rc7
v5.15.1
v5.15.10
v5.15.11
v5.15.12
v5.15.13
v5.15.14
v5.15.15
v5.15.16
v5.15.17
v5.15.18
v5.15.19
v5.15.2
v5.15.20
v5.15.21
v5.15.22
v5.15.23
v5.15.24
v5.15.25
v5.15.3
v5.15.4
v5.15.5
v5.15.6
v5.15.7
v5.15.8
v5.15.9
v5.16
v5.16-rc1
v5.16-rc2
v5.16-rc3
v5.16-rc4
v5.16-rc5
v5.16-rc6
v5.16-rc7
v5.16-rc8
v5.16.1
v5.16.10
v5.16.11
v5.16.2
v5.16.3
v5.16.4
v5.16.5
v5.16.6
v5.16.7
v5.16.8
v5.16.9
v5.17-rc1
v5.17-rc2
v5.17-rc3

Database specific 

{
    "vanir_signatures": [
        {
            "signature_version": "v1",
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "275821332328622989347659137096821028494",
                    "288046749044626985278615607705757676911",
                    "131252506681997736613683953231208300666",
                    "81317853551150705355830060393493430540"
                ]
            },
            "id": "CVE-2022-48940-192ec39e",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@719d1c2524c89ada78c4c9202641c1d9e942a322",
            "deprecated": false,
            "target": {
                "file": "include/linux/bpf.h"
            }
        },
        {
            "signature_version": "v1",
            "signature_type": "Function",
            "digest": {
                "length": 695.0,
                "function_hash": "4471612576502124201385317535371528735"
            },
            "id": "CVE-2022-48940-34f6a6ab",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eca9bd215d2233de79d930fa97aefbce03247a98",
            "deprecated": false,
            "target": {
                "file": "include/linux/bpf.h",
                "function": "copy_map_value"
            }
        },
        {
            "signature_version": "v1",
            "signature_type": "Function",
            "digest": {
                "length": 695.0,
                "function_hash": "4471612576502124201385317535371528735"
            },
            "id": "CVE-2022-48940-8ba67238",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@719d1c2524c89ada78c4c9202641c1d9e942a322",
            "deprecated": false,
            "target": {
                "file": "include/linux/bpf.h",
                "function": "copy_map_value"
            }
        },
        {
            "signature_version": "v1",
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "275821332328622989347659137096821028494",
                    "288046749044626985278615607705757676911",
                    "131252506681997736613683953231208300666",
                    "81317853551150705355830060393493430540"
                ]
            },
            "id": "CVE-2022-48940-dbd870f4",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8abb0c3dc1e28454851a00f8b7333d9695d566c",
            "deprecated": false,
            "target": {
                "file": "include/linux/bpf.h"
            }
        },
        {
            "signature_version": "v1",
            "signature_type": "Line",
            "digest": {
                "threshold": 0.9,
                "line_hashes": [
                    "275821332328622989347659137096821028494",
                    "288046749044626985278615607705757676911",
                    "131252506681997736613683953231208300666",
                    "81317853551150705355830060393493430540"
                ]
            },
            "id": "CVE-2022-48940-e8ffcbce",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eca9bd215d2233de79d930fa97aefbce03247a98",
            "deprecated": false,
            "target": {
                "file": "include/linux/bpf.h"
            }
        },
        {
            "signature_version": "v1",
            "signature_type": "Function",
            "digest": {
                "length": 695.0,
                "function_hash": "4471612576502124201385317535371528735"
            },
            "id": "CVE-2022-48940-f0be764f",
            "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a8abb0c3dc1e28454851a00f8b7333d9695d566c",
            "deprecated": false,
            "target": {
                "file": "include/linux/bpf.h",
                "function": "copy_map_value"
            }
        }
    ]
}

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.15.0
Fixed
5.15.26
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
5.16.12