CVE-2022-48770

What it actually does

Missing NULL check on task_pt_regs() return value inside bpf_get_task_stack() allows a NULL pointer dereference when the function is called on kernel threads on powerpc, resulting in a kernel oops.

Why it matters to the business

Systems running affected Linux kernels on powerpc can experience unexpected kernel crashes when BPF programs invoke bpf_get_task_stack(), causing denial of service and potential loss of availability for workloads relying on those systems.

How an attack unfolds

An attacker with the ability to load and execute a BPF program that calls bpf_get_task_stack() on a kernel thread can trigger the missing NULL check on powerpc, causing the kernel to dereference a NULL pt_regs pointer and panic.

How to fix it

Update the Linux kernel to a version containing commit ff6bdc205fd0a83bd365405d4e31fb5905826996 or later; rebuild and deploy the fixed kernel image on all powerpc systems.

How to confirm the fix worked

Confirm the running kernel contains commit ff6bdc205fd0a83bd365405d4e31fb5905826996 by inspecting /proc/version or the kernel build log, then verify that bpf_get_task_stack() calls on kernel threads no longer trigger oops under test workloads.

Typical attack path

1. Obtain capability to load BPF programs on a powerpc Linux system
2. Craft or load a BPF program that invokes bpf_get_task_stack() against a kernel thread
3. Trigger execution of the program to reach the unchecked task_pt_regs() result
4. Cause NULL pointer dereference leading to kernel oops and system crash

How to detect it

Search kernel logs and dmesg for oops or panic messages containing bpf_get_task_stack or task_pt_regs on powerpc systems; review audit logs for unexpected BPF program loads around the time of any crashes.

What your security team should do

• Prioritize kernel updates on all powerpc production systems within the next maintenance window
• Audit any custom BPF programs that use bpf_get_task_stack() and test them on powerpc hardware after patching
• Monitor kernel logs for oops messages referencing bpf_get_task_stack or task_pt_regs until patches are applied