CVE-2022-50650

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix reference state management for synchronous callbacks

Currently, verifier verifies callback functions (sync and async) as if

they will be executed once, (i.e. it explores execution state as if the

function was being called once). The next insn to explore is set to

start of subprog and the exit from nested frame is handled using

curframe > 0 and prepare_func_exit. In case of async callback it uses a

customized variant of push_stack simulating a kind of branch to set up

custom state and execution context for the async callback.

While this approach is simple and works when callback really will be

executed only once, it is unsafe for all of our current helpers which

are for_each style, i.e. they execute the callback multiple times.

A callback releasing acquired references of the caller may do so

multiple times, but currently verifier sees it as one call inside the

frame, which then returns to caller. Hence, it

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References