Cloudanix VulnDB

CVE-2022-50883

None

CVSS

—

EPSS

0.2%

Published

Dec 30, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's handling of certain program metadata could let an attacker crash the system by loading specially crafted data.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The flaw allows a malformed BTF type section containing a decl_tag referenced from a func_proto argument to bypass validation in btf_func_proto_check, leading to invalid type state during btf_parse_type_sec and potential kernel oops or memory corruption on BPF program load.

Why it matters to the business

Unpatched kernels can experience crashes or instability when untrusted BPF programs or BTF data are loaded, disrupting services that rely on eBPF for networking, observability, or security tooling and requiring emergency reboots or kernel updates.

How an attack unfolds

An attacker crafts a BTF blob with a decl_tag attached to a function prototype argument, loads it via the bpf syscall (bpf_btf_load), and triggers the missing check in btf_check_all_types, causing the kernel to dereference invalid type data.

How to fix it

Update the Linux kernel to a version containing commit 3f3d54962a032581996edda8e6bcbf7a30371234 or later; rebuild and deploy the updated kernel across all affected systems.

How to confirm the fix worked

Confirm the running kernel git commit is at or beyond 3f3d54962a032581996edda8e6bcbf7a30371234; test BPF program loading with crafted decl_tag BTF data to verify rejection.

Typical attack path

  1. Craft malicious BTF data embedding decl_tag in func_proto argument
  2. Invoke bpf_btf_load or bpf_prog_load syscall with the crafted BTF
  3. Trigger btf_parse_type_sec and btf_func_proto_check
  4. Cause kernel panic or memory corruption during type validation

How to detect it

Review kernel logs for oops or warnings originating from btf_func_proto_check or btf_parse_type_sec; inspect audit logs for unusual bpf syscalls from untrusted processes.

What your security team should do

  • Prioritize kernel upgrade to the fixed commit on all production systems
  • Restrict unprivileged BPF loading via sysctl kernel.unprivileged_bpf_disabled=1 until patched
  • Monitor for kernel oops related to btf_parse_type_sec in system logs

The record

In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent decl_tag from being referenced in func_proto arg Syzkaller managed to hit another decl_tag issue: btf_func_proto_check kernel/bpf/btf.c:4506 [inline] btf_check_all_types kernel/bpf/btf.c:4734 [inline] btf_parse_type_sec+0x1175/0x1980 kernel/bpf/btf.c:4763 btf_parse kernel/bpf/btf.c:5042 [inline] btf_new_fd+0x65a/0xb00 kernel/bpf/btf.c:6709 bpf_btf_load+0x6f/0x90 kernel/bpf/syscall.c:4342 __sys_bpf+0x50a/0x6c0 kernel/bpf/syscall.c:5034 __do_sys_bpf kernel/bpf/syscall.c:5093 [inline] __se_sys_bpf kernel/bpf/syscall.c:5091 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5091 do_syscall_64+0x54/0x70 arch/x86/entry/common.c:48 This seems similar to commit ea68376c8bed ("bpf: prevent decl_tag from being referenced in func_proto") but for the argument.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 0 5.4.229
Linux Kernel 5.16.0 6.0.16
SUSE:Linux Enterprise Micro 5.5 kernel-rt 0 5.14.21-150500.13.118.1
SUSE:Linux Enterprise Micro 5.5 kernel-source-rt 0 5.14.21-150500.13.118.1

Related vulnerabilities