CVE-2022-0433

What it actually does

NULL pointer dereference in the BPF bloom filter map_get_next_key function causes kernel panic and system crash when triggered by a local process.

Why it matters to the business

Local users can trigger denial-of-service crashes on affected Linux systems, interrupting services and requiring reboots; the issue has been public for years with no known active exploitation or ransomware use.

How an attack unfolds

An attacker with local access crafts input to invoke map_get_next_key on a BPF bloom filter map in a way that triggers the NULL dereference, crashing the kernel; no named threat actors or campaigns are associated.

How to fix it

Upgrade the Linux kernel to version 5.17-rc1 or later; apply vendor kernel updates for affected distributions such as Fedora.

How to confirm the fix worked

Verify running kernel version is 5.17 or newer; confirm absence of the vulnerable map_get_next_key implementation via source inspection or vendor advisories.

Typical attack path

1. Obtain local shell or process execution on target system
2. Load or interact with a BPF bloom filter map
3. Invoke map_get_next_key with crafted parameters to trigger the flaw
4. Cause kernel NULL dereference and system crash

How to detect it

Inspect kernel logs and crash dumps for NULL pointer dereference oops messages referencing BPF or map_get_next_key; correlate with local process activity around bloom filter map operations.

• map_get_next_key
• bpf bloom filter
• NULL pointer dereference in kernel/bpf

What your security team should do

• Apply kernel updates to 5.17+ on all affected systems as soon as possible
• Restrict untrusted local user access where feasible until patched
• Monitor for kernel oops/panic reports involving BPF
• Review system logs for BPF-related crashes as part of routine hardening