{
   "containers": {
      "cna": {
         "providerMetadata": {
            "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038"
         },
         "descriptions": [
            {
               "lang": "en",
               "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix crash due to out of bounds access into reg2btf_ids.\n\nWhen commit e6ac2450d6de (\"bpf: Support bpf program calling kernel function\") added\nkfunc support, it defined reg2btf_ids as a cheap way to translate the verifier\nreg type to the appropriate btf_vmlinux BTF ID, however\ncommit c25b2ae13603 (\"bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL\")\nmoved the __BPF_REG_TYPE_MAX from the last member of bpf_reg_type enum to after\nthe base register types, and defined other variants using type flag\ncomposition. However, now, the direct usage of reg->type to index into\nreg2btf_ids may no longer fall into __BPF_REG_TYPE_MAX range, and hence lead to\nout of bounds access and kernel crash on dereference of bad pointer."
            }
         ],
         "affected": [
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "kernel/bpf/btf.c"
               ],
               "versions": [
                  {
                     "version": "e8efe8369944",
                     "lessThan": "8c39925e98d4",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "931e56be527f",
                     "lessThan": "f0ce1bc9e023",
                     "status": "affected",
                     "versionType": "git"
                  },
                  {
                     "version": "c25b2ae13603",
                     "lessThan": "45ce4b4f9009",
                     "status": "affected",
                     "versionType": "git"
                  }
               ]
            },
            {
               "product": "Linux",
               "vendor": "Linux",
               "defaultStatus": "unaffected",
               "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
               "programFiles": [
                  "kernel/bpf/btf.c"
               ],
               "versions": [
                  {
                     "version": "5.15.15",
                     "lessThan": "5.15.37",
                     "status": "affected",
                     "versionType": "custom"
                  },
                  {
                     "version": "5.16.1",
                     "lessThan": "5.16.12",
                     "status": "affected",
                     "versionType": "custom"
                  }
               ]
            }
         ],
         "references": [
            {
               "url": "https://git.kernel.org/stable/c/8c39925e98d498b9531343066ef82ae39e41adae"
            },
            {
               "url": "https://git.kernel.org/stable/c/f0ce1bc9e0235dd7412240be493d7ea65ed9eadc"
            },
            {
               "url": "https://git.kernel.org/stable/c/45ce4b4f9009102cd9f581196d480a59208690c1"
            }
         ],
         "title": "bpf: Fix crash due to out of bounds access into reg2btf_ids.",
         "x_generator": {
            "engine": "bippy-c9c4e1df01b2"
         }
      }
   },
   "cveMetadata": {
      "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038",
      "cveID": "CVE-2022-48929",
      "requesterUserId": "gregkh@kernel.org",
      "serial": "1",
      "state": "PUBLISHED"
   },
   "dataType": "CVE_RECORD",
   "dataVersion": "5.0"
}