CVE-2022-2785

What it actually does

Arbitrary memory read in the Linux kernel BPF subsystem: constants provided to fill pointers in structs passed to bpf_sys_bpf are not verified and may reference any memory address, including kernel memory outside BPF-owned regions. An attacker holding CAP_BPF can therefore read arbitrary system memory.

Why it matters to the business

Local privileged attackers could disclose sensitive kernel data or use the read primitive to facilitate further kernel exploitation on affected Linux systems, increasing risk of information leakage or privilege escalation in environments where untrusted code can obtain CAP_BPF.

How an attack unfolds

An attacker first obtains the CAP_BPF capability, then loads a malicious BPF program that invokes bpf_sys_bpf with crafted pointer constants. Because pointer validation is absent, the kernel dereferences attacker-controlled addresses, returning memory contents that the attacker can exfiltrate.

How to fix it

Upgrade the Linux kernel past commit 86f44fcec22c. Apply distribution-specific patches that backport the pointer verification fix. Where immediate patching is impossible, restrict CAP_BPF grants via seccomp, LSM policies, or container runtimes.

How to confirm the fix worked

Confirm the running kernel contains commit 86f44fcec22c or later equivalent patch; review kernel source for the added pointer validation logic in bpf_sys_bpf; test that crafted invalid pointers now produce errors instead of memory reads.

Typical attack path

1. Obtain CAP_BPF capability on a target system
2. Craft and load a BPF program containing bpf_sys_bpf calls with invalid pointer constants
3. Trigger the program to read arbitrary kernel memory
4. Exfiltrate or reuse disclosed data for further attacks

How to detect it

Review kernel audit logs and BPF event traces for unusual bpf_sys_bpf invocations or programs that reference non-BPF memory regions; correlate with processes holding CAP_BPF; inspect for post-exploitation artifacts such as unexpected memory dumps or capability abuse patterns.

What your security team should do

• Prioritize kernel upgrades on all systems that allow CAP_BPF
• Audit and minimize processes or containers granted CAP_BPF
• Enable kernel audit logging for BPF program loads and capability use
• Consider additional hardening such as lockdown mode or LSM enforcement of BPF