CVE-2022-49341

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

bpf, arm64: Clear prog->jited_len along prog->jited

syzbot reported an illegal copy_to_user() attempt

from bpf_prog_get_info_by_fd() [1]

There was no repro yet on this bug, but I think

that commit 0aef499f3172 ("mm/usercopy: Detect vmalloc overruns")

is exposing a prior bug in bpf arm64.

bpf_prog_get_info_by_fd() looks at prog->jited_len

to determine if the JIT image can be copied out to user space.

My theory is that syzbot managed to get a prog where prog->jited_len

has been set to 43, while prog->bpf_func has ben cleared.

It is not clear why copy_to_user(uinsns, NULL, ulen) is triggering

this particular warning.

I thought find_vma_area(NULL) would not find a vm_struct.

As we do not hold vmap_area_lock spinlock, it might be possible

that the found vm_struct was garbage.

[1]

usercopy: Kernel memory exposure attempt detected from vmalloc (offset 792633534417210172, size 43)!

kernel BUG at mm/usercopy.c:101!

Inte

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References