Vulnerability · Published Sep 23, 2022 · Assigned by Google

CVE-2022-2785Arbitrary Memory read in BPF Linux Kernel

Medium 6.7

In plain English

A medium-severity out-of-bounds read in Kernel from Linux Kernel. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.7Medium

Exploit odds (30 days)0.3%top 81.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpf_sys_bpf are not verified and can point anywhere, including memory not owned by BPF. An attacker with CAP_BPF can arbitrarily read memory from anywhere on the system. We recommend upgrading past commit 86f44fcec22c

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	linux	5.19.6-1	DEBIAN-CVE-2022-2785
Debian:13	linux	5.19.6-1	DEBIAN-CVE-2022-2785
Debian:14	linux	5.19.6-1	DEBIAN-CVE-2022-2785

Affected products (as reported)

Vendor	Product	Versions
Linux Kernel	Kernel	5.14 – before af2ac3e13e455.18 – before b1d18a7574d0

Weakness: CWE-125 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

https://git.kernel.org/bpf/bpf/c/86f44fcec22c x_refsource_MISC
https://lore.kernel.org/bpf/20220816205517.682470-1-zhuyifei%40google.com/T/#t x_refsource_MISC