CVE-2022-49985

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.19.0

Description The issue is related to the use of tnum range in array range checking for poke descriptors in the Linux kernel. A problem arises when a range of tnum range(0, map->max entries - 1) has limited ability to represent the concrete tight range with the tnum as the set of resulting states from value + mask can result in a superset of the actual intended range. This can cause a tnum in(range, reg->var off) check to yield true when it shouldn't. The issue was reported by Hsin-Wei and is based on a customized syzkaller.

Recommendations For Linux kernel versions prior to 5.19.0, update to version 5.19.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable bpf int jit compile function until a patch is available. Avoid using the reg->var off variable in the affected array range checking until the issue is resolved.