CVE-2022-2905

What it actually does

The flaw permits a local user to trigger an out-of-bounds memory read in the BPF subsystem by invoking bpf_tail_call with a map key exceeding the map's max_entries limit, exposing adjacent kernel memory contents.

Why it matters to the business

Organizations running unpatched Linux kernels face potential leakage of sensitive kernel memory to local attackers, which can aid further privilege escalation or data theft on affected systems; the vulnerability has been public for over four years with public exploit code available, though EPSS remains low.

How an attack unfolds

An attacker with local access compiles a malicious BPF program that calls bpf_tail_call using an oversized key, reads the resulting out-of-bounds data, and uses the leaked information to bypass protections or escalate privileges; listed threat actor references point to similar recent Linux kernel privilege-escalation patterns.

How to fix it

Update the Linux kernel to a version containing commit 4fe89d07dcc2804c8b562f6c7896a45643d34b2f or later; rebuild and reboot with the patched kernel; apply vendor-specific backports where available for supported distributions.

How to confirm the fix worked

Verify the running kernel contains commit 4fe89d07dcc2804c8b562f6c7896a45643d34b2f via git log or package version checks; attempt to load a test BPF program exercising bpf_tail_call with an out-of-range key and confirm no memory disclosure occurs.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Load a crafted BPF program that invokes bpf_tail_call with an invalid key
3. Trigger the out-of-bounds read to capture kernel memory contents
4. Analyze leaked data to locate credentials, addresses, or bypasses
5. Leverage obtained information for further kernel exploitation

How to detect it

Review kernel audit logs and BPF event traces for unusual tail_call invocations; inspect system call logs for bpf() operations followed by unexpected memory access patterns; correlate with local privilege-escalation attempts in process execution history.

What your security team should do

• Immediately upgrade all Linux systems to kernels including commit 4fe89d07dcc2804c8b562f6c7896a45643d34b2f
• Restrict untrusted local user access to BPF via system policies until patches are applied
• Monitor for new public exploits targeting this class of BPF map handling issues
• Include BPF subsystem tests in kernel regression suites