CVE-2022-48929

What it actually does

Out-of-bounds array indexing into reg2btf_ids when a composed BPF register type is used to index the table, resulting in dereference of an invalid pointer and kernel crash.

Why it matters to the business

Local users can trigger kernel panics that cause denial of service on Linux systems running affected kernels; widespread impact due to presence in Android and many Linux distributions.

How an attack unfolds

An attacker with local access crafts a BPF program that exercises a register type whose numeric value exceeds the original __BPF_REG_TYPE_MAX bound; the verifier performs an unchecked array access into reg2btf_ids, dereferences an invalid pointer, and crashes the kernel.

How to fix it

Upgrade the Linux kernel to a fixed version such as 5.16.12 or the commit 8c39925e98d498b9531343066ef82ae39e41adae and later stable releases; apply vendor patches for Android SoC versions dated 2021-11-05 or newer.

How to confirm the fix worked

Verify the running kernel version is at or above the listed fixed releases; attempt to load a minimal BPF program exercising the affected register types and confirm absence of crash; review kernel build logs for the backported fix.

Typical attack path

1. Obtain local user or unprivileged container access on a vulnerable kernel
2. Load a specially constructed BPF program via bpf() syscall that triggers a composed register type
3. Cause the verifier to index reg2btf_ids with a value outside the intended range
4. Trigger dereference of the resulting invalid pointer leading to kernel oops/panic

How to detect it

Search kernel logs (dmesg, /var/log/kern.log, journalctl) for oops/panic messages referencing bpf, reg2btf_ids, or out-of-bounds access in the verifier; correlate with recent bpf() syscall activity from unprivileged processes.

• kernel: BUG: unable to handle kernel paging request at.*reg2btf_ids
• bpf_verifier.*out of bounds access

What your security team should do

• Prioritize kernel upgrades on all internet-facing and multi-tenant systems within the next maintenance window
• Restrict unprivileged BPF loading via sysctl kernel.unprivileged_bpf_disabled=1 until patches are applied
• Monitor for kernel oops reports containing bpf verifier paths