CVE-2022-48713

What it actually does

Null pointer dereference in pt_handle_status when a PT stop filter triggers in single-range output mode without a ToPA buffer configured, introduced by incomplete guarding of buf->single checks.

Why it matters to the business

Kernel crashes on systems using affected perf PT tracing with stop filters can cause denial of service and operational disruption; the issue appears in Cilium environments with the listed commit prevalence indicating broad downstream exposure.

How an attack unfolds

An attacker with ability to configure Intel PT stop filters and initiate tracing in single-range mode triggers the hardware stop condition, leading to the unhandled null dereference and crash; no named threat actors are confirmed exploiting this specific flaw.

How to fix it

Update cilium/cilium to commit 7cf5782920423b07e7a4e6e67fafd81e1d4a1d33 or later; apply equivalent upstream Linux kernel patches for perf/x86/intel/pt if building custom kernels.

How to confirm the fix worked

Confirm the patch commit is present in the running kernel or Cilium build; reproduce stop-filter hit during PT recording to verify no crash occurs.

Typical attack path

1. Gain sufficient privileges to configure perf PT tracing and stop filter ranges
2. Enable single-range output mode tracing
3. Execute code that hits the configured stop filter range
4. Trigger null dereference in pt_handle_status due to missing ToPA check

How to detect it

Search kernel logs for oops or panic messages referencing pt_handle_status, pt_buffer_region_size, or single-range PT mode; correlate with perf PT tracing sessions that include stop filters.

What your security team should do

• Apply the listed fixed commit immediately in Cilium deployments using perf PT
• Monitor for kernel oops or panics involving pt_handle_status or pt_buffer_region_size
• Disable single-range PT mode where possible until patched