Log in Start free

Vulnerability · Published May 1, 2025 · Assigned by Linux

CVE-2022-49764bpf: Prevent bpf program recursion for raw tracepoint probes

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 91.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent bpf program recursion for raw tracepoint probes We got report from sysbot [1] about warnings that were caused by bpf program attached to contention_begin raw tracepoint triggering the same tracepoint by using bpf_trace_printk helper that takes trace_printk_lock lock. Call Trace: <TASK> ? trace_event_raw_event_bpf_trace_printk+0x5f/0x90 bpf_trace_printk+0x2b/0xe0 bpf_prog_a9aec6167c091eef_prog+0x1f/0x24 bpf_trace_run2+0x26/0x90 native_queued_spin_lock_slowpath+0x1c6/0x2b0 _raw_spin_lock_irqsave+0x44/0x50 bpf_trace_printk+0x3f/0xe0 bpf_prog_a9aec6167c091eef_prog+0x1f/0x24 bpf_trace_run2+0x26/0x90 native_queued_spin_lock_slowpath+0x1c6/0x2b0 _raw_spin_lock_irqsave+0x44/0x50 bpf_trace_printk+0x3f/0xe0 bpf_prog_a9aec6167c091eef_prog+0x1f/0x24 bpf_trace_run2+0x26/0x90 native_queued_spin_lock_slowpath+0x1c6/0x2b0 _raw_spin_lock_irqsave+0x44/0x50 bpf_trace_printk+0x3f/0xe0 bpf_prog_a9aec6167c091eef_prog+0x1f/0x24 bpf_trace_run2+0x26/0x90 native_queued_spin_lock_slowpath+0x1c6/0x2b0 _raw_spin_lock_irqsave+0x44/0x50 __unfreeze_partials+0x5b/0x160 ... The can be reproduced by attaching bpf program as raw tracepoint on contention_begin tracepoint. The bpf prog calls bpf_trace_printk helper. Then by running perf bench the spin lock code is forced to take slow path and call contention_begin tracepoint. Fixing this by skipping execution of the bpf program if it's already running, Using bpf prog 'active' field, which is being currently used by trampoline programs for the same reason. Moving bpf_prog_inc_misses_counter to syscall.c because trampoline.c is compiled in just for CONFIG_BPF_JIT option. [1] https://lore.kernel.org/bpf/YxhFe3EwqchC%2FfYf@krava/T/#t

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.0.10-1DEBIAN-CVE-2022-49764
Debian:13linux6.0.10-1DEBIAN-CVE-2022-49764
Debian:14linux6.0.10-1DEBIAN-CVE-2022-49764
Ubuntu:22.04:LTSlinuxno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-awsno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-azureno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-intel-iotgno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-kvmno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-nvidia-tegrano fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-nvidia-tegra-igxno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-raspino fix listedUBUNTU-CVE-2022-49764
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-49764
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-49764
Ubuntu:22.04:LTSlinux-xilinx-zynqmpno fix listedUBUNTU-CVE-2022-49764

Affected products (as reported)

VendorProductVersions
Linux Linux c4f6699dfcb8558d138fe838f741b2c10f416cf9 – before 2e5399879024fedd6cdc41f73fbf9bbe7208f899c4f6699dfcb8558d138fe838f741b2c10f416cf9 – before 05b24ff9b2cfabfcfd951daaa915a036ab53c9e1
Linux Linux 4.17

References