CVE-2022-49873: bpf: Fix wrong reg type conversion in release_reference()
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix wrong reg type conversion in release_reference()
Some helper functions will allocate memory. To avoid memory leaks, the
verifier requires the eBPF program to release these memories by calling
the corresponding helper functions.
When a resource is released, all pointer registers corresponding to the
resource should be invalidated. The verifier use release_references() to
do this job, by apply __mark_reg_unknown() to each relevant register.
It will give these registers the type of SCALAR_VALUE. A register that
will contain a pointer value at runtime, but of type SCALAR_VALUE, which
may allow the unprivileged user to get a kernel pointer by storing this
register into a map.
Using __mark_reg_not_init() while NOT allow_ptr_leaks can mitigate this
problem.
Security readout for executives and security teams
Plain-English summary
This Linux kernel eBPF verifier flaw can mishandle pointer registers after a resource is released. A local low-privileged user may be able to retain sensitive pointer-like values or trigger kernel instability. It is not described as remotely exploitable, and the provided sources do not show active exploitation.
Executive priority
Handle through normal kernel patch management, with higher priority for shared Linux hosts or environments allowing untrusted local users. This is not supported as internet-facing remote code execution by the provided evidence.
Technical view
The bug is in release_references(), where released resource pointer registers were marked as SCALAR_VALUE instead of not-initialized when pointer leaks are disallowed. The CVE maps this to CWE-704 and CVSS 5.5, local attack vector, low complexity, low privileges, no user interaction, and high availability impact.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions where local users can interact with eBPF functionality. Multi-user Linux servers, developer hosts, and container platforms deserve priority review. The bundle lists Linux as affected but does not provide a full vendor-specific distribution matrix.
Exploitation context
The CVE is not in KEV, and the provided sources do not cite active exploitation. Exploitation requires local access and relevant eBPF capability or policy conditions. Treat public exploit status as unconfirmed from this bundle.
Researcher notes
Focus validation on eBPF verifier behavior around helper-allocated resources and register invalidation after release_reference(). Avoid assuming confidentiality or privilege-escalation impact beyond the source text and CVSS vector. Patch attribution should be confirmed against the kernel stable commits and downstream distribution backports.
Mitigation direction
Update affected Linux kernels using vendor or distribution guidance.
Prioritize kernels around affected eBPF verifier versions listed in the CVE bundle.
Restrict unprivileged eBPF access where operationally feasible.
Review kernel hardening settings related to pointer leaks and BPF use.
Monitor Linux vendor advisories for backported fixes.
Validation and detection
Inventory Linux kernel versions across servers and container hosts.
Confirm whether unprivileged users can load or interact with eBPF programs.
Map deployed kernels to the referenced stable kernel fixes.
Check distribution security advisories for patched package versions.
Review local audit logs for unusual BPF program activity.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cwe · low confidence lookup
CWE-704: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.