CVE-2022-3606

What it actually does

Null pointer dereference in find_prog_by_sec_insn within tools/lib/bpf/libbpf.c triggered by crafted BPF section instructions, resulting in kernel or userspace process crash.

Why it matters to the business

Local denial-of-service on Linux systems that compile or inspect BPF programs, potentially disrupting development workflows, monitoring tools, or container orchestration that relies on libbpf; low urgency given age and limited exploitability.

How an attack unfolds

An attacker with local access crafts a malicious BPF object file or eBPF program whose section layout causes find_prog_by_sec_insn to receive a null instruction pointer, dereferencing it and crashing the process or kernel context that invoked the function.

How to fix it

Upgrade the Linux kernel source tree to commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c or later; rebuild and deploy any affected BPF tooling or distributions that ship libbpf from the vulnerable tree.

How to confirm the fix worked

Confirm presence of commit c9c3395d5e3dcc6daee66c6908354d47bf98cb0c in the libbpf.c history; recompile libbpf and verify that find_prog_by_sec_insn no longer dereferences a null pointer on malformed input.

Typical attack path

1. Obtain local shell or container access on target Linux system
2. Prepare a malformed BPF ELF object containing crafted section metadata
3. Invoke libbpf APIs (bpf_object__open, bpf_object__load, or related tooling) against the object
4. Trigger null pointer dereference inside find_prog_by_sec_insn
5. Cause denial of service via process or system crash

How to detect it

Review kernel logs and application crash reports for segmentation faults or oops entries originating from libbpf or bpftool when processing untrusted BPF objects; correlate with process execution of bpftool, bpf_object__open_file, or similar libbpf callers.

What your security team should do

• Apply the referenced commit or upgrade to a distribution kernel that contains the fix
• Restrict untrusted local users from loading arbitrary BPF objects until patched
• Monitor for kernel oops or userspace crashes involving libbpf during BPF program compilation