235 lines
12 KiB
JSON
235 lines
12 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2022-50167",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2025-06-18T10:57:27.426Z",
|
||
"datePublished": "2025-06-18T11:03:20.997Z",
|
||
"dateUpdated": "2026-10-30T12:17:09.354Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-10-30T12:17:09.354Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix potential 32-bit overflow when accessing ARRAY map element\n\nIf BPF array map is bigger than 4GB, element pointer calculation can\noverflow because both index and elem_size are u32. Fix this everywhere\nby forcing 64-bit multiplication. Extract this formula into separate\nsmall helper and use it consistently in various places.\n\nSpeculative-preventing formula utilizing index_mask trick is left as is,\nbut explicit u64 casts are added in both places."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 7.8,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - The bug is in BPF ARRAY map element pointer math in kernel/bpf/arraymap.c, reached only via the local bpf(2) syscall (map create/lookup/update and map FD release), not via network packet processing.\nAC:L - An attacker who can create a >4GB ARRAY map fully controls map size, indices, timer arming, and FD close, so the 32-bit overflow and resulting bad pointer/timer mishandling are reliably triggerable with no conditions outside their control.\nPR:L - BPF ARRAY map create/use is available to an unprivileged local user when unprivileged BPF is enabled, and the higher-impact timer path needs only CAP_BPF (not full root); when uncertain, the lower privilege requirement is scored.\nUI:N - Exploitation requires only attacker-controlled bpf(2) operations and closing their own map FD; no victim user action is needed.\nS:U - Impact stays within the host kernel’s authority (local memory corruption / privilege escalation); there is no VM, IOMMU, or other security-authority boundary crossed.\nC:H - On map uref drop, array_map_free_timers skips high-index timers due to the overflow, leaving live hrtimers into map memory that is later freed—a use-after-free that can be leveraged for arbitrary kernel read.\nI:H - The same timer use-after-free (and wrong-element update/free of kernel-managed map fields) yields a corruptible kernel object and is exploitable for arbitrary write / control-flow hijacking.\nA:H - A use-after-free in a softirq hrtimer callback can oops/panic the kernel, and guidance treats any UAF as high availability impact even when not fully exploited."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"kernel/bpf/arraymap.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
|
||
"lessThan": "2157ac13db8d5763835f1663bdabda6de744cba8",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
|
||
"lessThan": "f665c56e6836933335e5a4513fc9b0bf47cdf81f",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
|
||
"lessThan": "063e092534d4c6785228e5b1eb6e9329f66ccbe4",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
|
||
"lessThan": "3c7256b880b3a5aa1895fd169a34aa4224a11862",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
|
||
"lessThan": "87ac0d600943994444e24382a87aa19acc4cd3d4",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"kernel/bpf/arraymap.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "5.3",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "5.3",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.273",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.224",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.18.18",
|
||
"lessThanOrEqual": "5.18.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.19.2",
|
||
"lessThanOrEqual": "5.19.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "6.0",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.3",
|
||
"versionEndExcluding": "5.10.273"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.3",
|
||
"versionEndExcluding": "5.15.224"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.3",
|
||
"versionEndExcluding": "5.18.18"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.3",
|
||
"versionEndExcluding": "5.19.2"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.3",
|
||
"versionEndExcluding": "6.0"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/2157ac13db8d5763835f1663bdabda6de744cba8"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/f665c56e6836933335e5a4513fc9b0bf47cdf81f"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/063e092534d4c6785228e5b1eb6e9329f66ccbe4"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/3c7256b880b3a5aa1895fd169a34aa4224a11862"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/87ac0d600943994444e24382a87aa19acc4cd3d4"
|
||
}
|
||
],
|
||
"title": "bpf: fix potential 32-bit overflow when accessing ARRAY map element",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2022-50167",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2026-10-15T21:30:17.190513Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-10-15T21:31:18.591Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |