Vulnerability-Lookup

FKIE_CVE-2022-48940

Vulnerability from fkie_nvd - Published: 2024-08-22 04:15 - Updated: 2026-08-04 10:17

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix crash due to incorrect copy_map_value When both bpf_spin_lock and bpf_timer are present in a BPF map value, copy_map_value needs to skirt both objects when copying a value into and out of the map. However, the current code does not set both s_off and t_off in copy_map_value, which leads to a crash when e.g. bpf_spin_lock is placed in map value with bpf_timer, as bpf_map_update_elem call will be able to overwrite the other timer object. When the issue is not fixed, an overwriting can produce the following splat: [root@(none) bpf]# ./test_progs -t timer_crash [ 15.930339] bpf_testmod: loading out-of-tree module taints kernel. [ 16.037849] ================================================================== [ 16.038458] BUG: KASAN: user-memory-access in __pv_queued_spin_lock_slowpath+0x32b/0x520 [ 16.038944] Write of size 8 at addr 0000000000043ec0 by task test_progs/325 [ 16.039399] [ 16.039514] CPU: 0 PID: 325 Comm: test_progs Tainted: G OE 5.16.0+ #278 [ 16.039983] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.15.0-1 04/01/2014 [ 16.040485] Call Trace: [ 16.040645] <TASK> [ 16.040805] dump_stack_lvl+0x59/0x73 [ 16.041069] ? __pv_queued_spin_lock_slowpath+0x32b/0x520 [ 16.041427] kasan_report.cold+0x116/0x11b [ 16.041673] ? __pv_queued_spin_lock_slowpath+0x32b/0x520 [ 16.042040] __pv_queued_spin_lock_slowpath+0x32b/0x520 [ 16.042328] ? memcpy+0x39/0x60 [ 16.042552] ? pv_hash+0xd0/0xd0 [ 16.042785] ? lockdep_hardirqs_off+0x95/0xd0 [ 16.043079] __bpf_spin_lock_irqsave+0xdf/0xf0 [ 16.043366] ? bpf_get_current_comm+0x50/0x50 [ 16.043608] ? jhash+0x11a/0x270 [ 16.043848] bpf_timer_cancel+0x34/0xe0 [ 16.044119] bpf_prog_c4ea1c0f7449940d_sys_enter+0x7c/0x81 [ 16.044500] bpf_trampoline_6442477838_0+0x36/0x1000 [ 16.044836] __x64_sys_nanosleep+0x5/0x140 [ 16.045119] do_syscall_64+0x59/0x80 [ 16.045377] ? lock_is_held_type+0xe4/0x140 [ 16.045670] ? irqentry_exit_to_user_mode+0xa/0x40 [ 16.046001] ? mark_held_locks+0x24/0x90 [ 16.046287] ? asm_exc_page_fault+0x1e/0x30 [ 16.046569] ? asm_exc_page_fault+0x8/0x30 [ 16.046851] ? lockdep_hardirqs_on+0x7e/0x100 [ 16.047137] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 16.047405] RIP: 0033:0x7f9e4831718d [ 16.047602] Code: b4 0c 00 0f 05 eb a9 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d b3 6c 0c 00 f7 d8 64 89 01 48 [ 16.048764] RSP: 002b:00007fff488086b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000023 [ 16.049275] RAX: ffffffffffffffda RBX: 00007f9e48683740 RCX: 00007f9e4831718d [ 16.049747] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff488086d0 [ 16.050225] RBP: 00007fff488086f0 R08: 00007fff488085d7 R09: 00007f9e4cb594a0 [ 16.050648] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f9e484cde30 [ 16.051124] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 16.051608] </TASK> [ 16.051762] ==================================================================

References

URL	Tags
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/719d1c2524c89ada78c4c9202641c1d9e942a322	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a8abb0c3dc1e28454851a00f8b7333d9695d566c	Patch
416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/eca9bd215d2233de79d930fa97aefbce03247a98	Patch

Impacted products

	Vendor	Product	Version
	linux	linux_kernel	*
	linux	linux_kernel	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "719d1c2524c89ada78c4c9202641c1d9e942a322",
              "status": "affected",
              "version": "68134668c17f31f51930478f75495b552a411550",
              "versionType": "git"
            },
            {
              "lessThan": "eca9bd215d2233de79d930fa97aefbce03247a98",
              "status": "affected",
              "version": "68134668c17f31f51930478f75495b552a411550",
              "versionType": "git"
            },
            {
              "lessThan": "a8abb0c3dc1e28454851a00f8b7333d9695d566c",
              "status": "affected",
              "version": "68134668c17f31f51930478f75495b552a411550",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD0395FB-2D21-4970-B193-86285F5C505E",
              "versionEndExcluding": "5.15.26",
              "versionStartIncluding": "5.15",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C76BAB21-7F23-4AD8-A25F-CA7B262A2698",
              "versionEndExcluding": "5.16.12",
              "versionStartIncluding": "5.16",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix crash due to incorrect copy_map_value\n\nWhen both bpf_spin_lock and bpf_timer are present in a BPF map value,\ncopy_map_value needs to skirt both objects when copying a value into and\nout of the map. However, the current code does not set both s_off and\nt_off in copy_map_value, which leads to a crash when e.g. bpf_spin_lock\nis placed in map value with bpf_timer, as bpf_map_update_elem call will\nbe able to overwrite the other timer object.\n\nWhen the issue is not fixed, an overwriting can produce the following\nsplat:\n\n[root@(none) bpf]# ./test_progs -t timer_crash\n[   15.930339] bpf_testmod: loading out-of-tree module taints kernel.\n[   16.037849] ==================================================================\n[   16.038458] BUG: KASAN: user-memory-access in __pv_queued_spin_lock_slowpath+0x32b/0x520\n[   16.038944] Write of size 8 at addr 0000000000043ec0 by task test_progs/325\n[   16.039399]\n[   16.039514] CPU: 0 PID: 325 Comm: test_progs Tainted: G           OE     5.16.0+ #278\n[   16.039983] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.15.0-1 04/01/2014\n[   16.040485] Call Trace:\n[   16.040645]  \u003cTASK\u003e\n[   16.040805]  dump_stack_lvl+0x59/0x73\n[   16.041069]  ? __pv_queued_spin_lock_slowpath+0x32b/0x520\n[   16.041427]  kasan_report.cold+0x116/0x11b\n[   16.041673]  ? __pv_queued_spin_lock_slowpath+0x32b/0x520\n[   16.042040]  __pv_queued_spin_lock_slowpath+0x32b/0x520\n[   16.042328]  ? memcpy+0x39/0x60\n[   16.042552]  ? pv_hash+0xd0/0xd0\n[   16.042785]  ? lockdep_hardirqs_off+0x95/0xd0\n[   16.043079]  __bpf_spin_lock_irqsave+0xdf/0xf0\n[   16.043366]  ? bpf_get_current_comm+0x50/0x50\n[   16.043608]  ? jhash+0x11a/0x270\n[   16.043848]  bpf_timer_cancel+0x34/0xe0\n[   16.044119]  bpf_prog_c4ea1c0f7449940d_sys_enter+0x7c/0x81\n[   16.044500]  bpf_trampoline_6442477838_0+0x36/0x1000\n[   16.044836]  __x64_sys_nanosleep+0x5/0x140\n[   16.045119]  do_syscall_64+0x59/0x80\n[   16.045377]  ? lock_is_held_type+0xe4/0x140\n[   16.045670]  ? irqentry_exit_to_user_mode+0xa/0x40\n[   16.046001]  ? mark_held_locks+0x24/0x90\n[   16.046287]  ? asm_exc_page_fault+0x1e/0x30\n[   16.046569]  ? asm_exc_page_fault+0x8/0x30\n[   16.046851]  ? lockdep_hardirqs_on+0x7e/0x100\n[   16.047137]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[   16.047405] RIP: 0033:0x7f9e4831718d\n[   16.047602] Code: b4 0c 00 0f 05 eb a9 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d b3 6c 0c 00 f7 d8 64 89 01 48\n[   16.048764] RSP: 002b:00007fff488086b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000023\n[   16.049275] RAX: ffffffffffffffda RBX: 00007f9e48683740 RCX: 00007f9e4831718d\n[   16.049747] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff488086d0\n[   16.050225] RBP: 00007fff488086f0 R08: 00007fff488085d7 R09: 00007f9e4cb594a0\n[   16.050648] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f9e484cde30\n[   16.051124] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[   16.051608]  \u003c/TASK\u003e\n[   16.051762] =================================================================="
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: soluciona el fallo debido a copy_map_value incorrecto Cuando tanto bpf_spin_lock como bpf_timer est\u00e1n presentes en un valor de mapa BPF, copy_map_value necesita eludir ambos objetos al copiar un valor dentro y fuera del mapa. Sin embargo, el c\u00f3digo actual no establece s_off y t_off en copy_map_value, lo que provoca un bloqueo cuando, por ejemplo, bpf_spin_lock se coloca en el valor del mapa con bpf_timer, ya que la llamada a bpf_map_update_elem podr\u00e1 sobrescribir el otro objeto de temporizador. Cuando el problema no se soluciona, una sobrescritura puede producir el siguiente s\u00edmbolo: [root@(none) bpf]# ./test_progs -t timer_crash [15.930339] bpf_testmod: cargando el n\u00facleo de contaminaci\u00f3n del m\u00f3dulo fuera del \u00e1rbol. [16.037849] ================================================= =================== [16.038458] ERROR: KASAN: acceso a memoria de usuario en __pv_queued_spin_lock_slowpath+0x32b/0x520 [16.038944] Escritura de tama\u00f1o 8 en la direcci\u00f3n 0000000000043ec0 por tarea test_progs /325 [ 16.039399] [ 16.039514] CPU: 0 PID: 325 Comm: test_progs Contaminado: G OE 5.16.0+ #278 [ 16.039983] Nombre de hardware: PC est\u00e1ndar QEMU (i440FX + PIIX, 1996), BIOS ArchLinux 1.15.0- 1 01/04/2014 [ 16.040485] Seguimiento de llamadas: [ 16.040645]  [ 16.040805] dump_stack_lvl+0x59/0x73 [ 16.041069] ? __pv_queued_spin_lock_slowpath+0x32b/0x520 [ 16.041427] kasan_report.cold+0x116/0x11b [ 16.041673] ? __pv_queued_spin_lock_slowpath+0x32b/0x520 [16.042040] __pv_queued_spin_lock_slowpath+0x32b/0x520 [16.042328] ? memcpy+0x39/0x60 [16.042552]? pv_hash+0xd0/0xd0 [16.042785]? lockdep_hardirqs_off+0x95/0xd0 [ 16.043079] __bpf_spin_lock_irqsave+0xdf/0xf0 [ 16.043366] ? bpf_get_current_comm+0x50/0x50 [16.043608]? jhash+0x11a/0x270 [ 16.043848] bpf_timer_cancel+0x34/0xe0 [ 16.044119] bpf_prog_c4ea1c0f7449940d_sys_enter+0x7c/0x81 [ 16.044500] 7838_0+0x36/0x1000 [ 16.044836] __x64_sys_nanosleep+0x5/0x140 [ 16.045119] do_syscall_64+0x59/0x80 [ 16.045377] ? lock_is_held_type+0xe4/0x140 [16.045670]? irqentry_exit_to_user_mode+0xa/0x40 [16.046001]? mark_held_locks+0x24/0x90 [16.046287]? asm_exc_page_fault+0x1e/0x30 [16.046569]? asm_exc_page_fault+0x8/0x30 [16.046851]? lockdep_hardirqs_on+0x7e/0x100 [16.047137] Entry_SYSCALL_64_after_hwframe+0x44/0xae [16.047405] RIP: 0033:0x7f9e4831718d [16.047602] C\u00f3digo: b4 0c 00 0f 05 eb a9 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 8b 0d b3 6c 0c 00 f7 d8 64 89 01 48 [ 16.048764] : 002b:00007fff488086b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000023 [ 16.049275] RAX: ffffffffffffffda RBX: 00007f9e48683740 RCX: 00007f9e4831718d [ 16.049747] RDX: 000000000000 RSI: 0000000000000000 RDI: 00007fff488086d0 [ 16.050225] RBP: 00007fff488086f0 R08: 00007fff488085d7 R09: 00007f9e4cb594a0 [ 16.050648] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f9e484cde30 [ 16.051124] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 16.051608 ]  [ 16.051762] ========================= ============================================"
    }
  ],
  "id": "CVE-2022-48940",
  "lastModified": "2026-08-04T10:17:27.343",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-48940",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-09-10T15:32:21.126516Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-08-22T04:15:17.907",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/719d1c2524c89ada78c4c9202641c1d9e942a322"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/a8abb0c3dc1e28454851a00f8b7333d9695d566c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ],
      "url": "https://git.kernel.org/stable/c/eca9bd215d2233de79d930fa97aefbce03247a98"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2022-48940 (GCVE-0-2022-48940)

Vulnerability from cvelistv5 – Published: 2024-08-22 03:31 – Updated: 2026-08-05 08:53

Title

bpf: Fix crash due to incorrect copy_map_value

Summary

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-10 15:32 UTC

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/719d1c2524c89ada7…
https://git.kernel.org/stable/c/eca9bd215d2233de7…
https://git.kernel.org/stable/c/a8abb0c3dc1e28454…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 68134668c17f31f51930478f75495b552a411550 , < 719d1c2524c89ada78c4c9202641c1d9e942a322 (git) Affected: 68134668c17f31f51930478f75495b552a411550 , < eca9bd215d2233de79d930fa97aefbce03247a98 (git) Affected: 68134668c17f31f51930478f75495b552a411550 , < a8abb0c3dc1e28454851a00f8b7333d9695d566c (git)
Linux	Linux	Affected: 5.15 Unaffected: 0 , < 5.15 (semver) Unaffected: 5.15.26 , ≤ 5.15.* (semver) Unaffected: 5.16.12 , ≤ 5.16.* (semver) Unaffected: 5.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48940",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:32:21.126516Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:32:59.231Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "719d1c2524c89ada78c4c9202641c1d9e942a322",
              "status": "affected",
              "version": "68134668c17f31f51930478f75495b552a411550",
              "versionType": "git"
            },
            {
              "lessThan": "eca9bd215d2233de79d930fa97aefbce03247a98",
              "status": "affected",
              "version": "68134668c17f31f51930478f75495b552a411550",
              "versionType": "git"
            },
            {
              "lessThan": "a8abb0c3dc1e28454851a00f8b7333d9695d566c",
              "status": "affected",
              "version": "68134668c17f31f51930478f75495b552a411550",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/linux/bpf.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.26",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.26",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.12",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix crash due to incorrect copy_map_value\n\nWhen both bpf_spin_lock and bpf_timer are present in a BPF map value,\ncopy_map_value needs to skirt both objects when copying a value into and\nout of the map. However, the current code does not set both s_off and\nt_off in copy_map_value, which leads to a crash when e.g. bpf_spin_lock\nis placed in map value with bpf_timer, as bpf_map_update_elem call will\nbe able to overwrite the other timer object.\n\nWhen the issue is not fixed, an overwriting can produce the following\nsplat:\n\n[root@(none) bpf]# ./test_progs -t timer_crash\n[   15.930339] bpf_testmod: loading out-of-tree module taints kernel.\n[   16.037849] ==================================================================\n[   16.038458] BUG: KASAN: user-memory-access in __pv_queued_spin_lock_slowpath+0x32b/0x520\n[   16.038944] Write of size 8 at addr 0000000000043ec0 by task test_progs/325\n[   16.039399]\n[   16.039514] CPU: 0 PID: 325 Comm: test_progs Tainted: G           OE     5.16.0+ #278\n[   16.039983] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ArchLinux 1.15.0-1 04/01/2014\n[   16.040485] Call Trace:\n[   16.040645]  \u003cTASK\u003e\n[   16.040805]  dump_stack_lvl+0x59/0x73\n[   16.041069]  ? __pv_queued_spin_lock_slowpath+0x32b/0x520\n[   16.041427]  kasan_report.cold+0x116/0x11b\n[   16.041673]  ? __pv_queued_spin_lock_slowpath+0x32b/0x520\n[   16.042040]  __pv_queued_spin_lock_slowpath+0x32b/0x520\n[   16.042328]  ? memcpy+0x39/0x60\n[   16.042552]  ? pv_hash+0xd0/0xd0\n[   16.042785]  ? lockdep_hardirqs_off+0x95/0xd0\n[   16.043079]  __bpf_spin_lock_irqsave+0xdf/0xf0\n[   16.043366]  ? bpf_get_current_comm+0x50/0x50\n[   16.043608]  ? jhash+0x11a/0x270\n[   16.043848]  bpf_timer_cancel+0x34/0xe0\n[   16.044119]  bpf_prog_c4ea1c0f7449940d_sys_enter+0x7c/0x81\n[   16.044500]  bpf_trampoline_6442477838_0+0x36/0x1000\n[   16.044836]  __x64_sys_nanosleep+0x5/0x140\n[   16.045119]  do_syscall_64+0x59/0x80\n[   16.045377]  ? lock_is_held_type+0xe4/0x140\n[   16.045670]  ? irqentry_exit_to_user_mode+0xa/0x40\n[   16.046001]  ? mark_held_locks+0x24/0x90\n[   16.046287]  ? asm_exc_page_fault+0x1e/0x30\n[   16.046569]  ? asm_exc_page_fault+0x8/0x30\n[   16.046851]  ? lockdep_hardirqs_on+0x7e/0x100\n[   16.047137]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n[   16.047405] RIP: 0033:0x7f9e4831718d\n[   16.047602] Code: b4 0c 00 0f 05 eb a9 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d b3 6c 0c 00 f7 d8 64 89 01 48\n[   16.048764] RSP: 002b:00007fff488086b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000023\n[   16.049275] RAX: ffffffffffffffda RBX: 00007f9e48683740 RCX: 00007f9e4831718d\n[   16.049747] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007fff488086d0\n[   16.050225] RBP: 00007fff488086f0 R08: 00007fff488085d7 R09: 00007f9e4cb594a0\n[   16.050648] R10: 0000000000000000 R11: 0000000000000206 R12: 00007f9e484cde30\n[   16.051124] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000\n[   16.051608]  \u003c/TASK\u003e\n[   16.051762] =================================================================="
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is triggered through the local bpf() syscall (BPF_BTF_LOAD, BPF_MAP_CREATE, BPF_MAP_UPDATE_ELEM) into copy_map_value and array_map_update_elem; BPF is a local syscall interface, not reachable via network packets or adjacent protocols.\nAC:L - Creating an ARRAY/HASH map whose BTF value contains both bpf_spin_lock and bpf_timer, then calling BPF_MAP_UPDATE_ELEM with a crafted value, deterministically overwrites the timer object and invokes bpf_timer_cancel_and_free; no race or attacker-uncontrollable state is required.\nPR:L - On affected 5.15 kernels, unprivileged BPF was enabled by default (BPF_UNPRIV_DEFAULT_OFF lacked default y until 5.16), and map_check_btf imposed no bpf_capable() gate for timer+spin_lock maps, so an unprivileged local user can create the map and update elements via bpf() alone.\nUI:N - The attacker performs BTF load, map create, and map update themselves; no victim action such as mounting a filesystem or opening a device is required.\nS:U - Memory corruption is confined to the host kernel\u2019s security authority (local privilege escalation via kernel heap corruption); this is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - Overwriting bpf_timer_kern with attacker-controlled bytes yields a corrupted kernel pointer passed into bpf_timer_cancel_and_free/hrtimer paths, a memory-corruption primitive that can be leveraged for arbitrary kernel reads.\nI:H - The same overwrite gives a controlled pointer into bpf_timer_cancel_and_free (hrtimer_cancel and kfree on attacker-chosen addresses), a classic arbitrary-free/write primitive suitable for control-flow hijacking.\nA:H - The demonstrated effect is a kernel oops/KASAN crash (user-memory-access in spinlock paths on the corrupted timer), and the resulting memory corruption can panic the system and is re-triggerable at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:53:01.254Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/719d1c2524c89ada78c4c9202641c1d9e942a322"
        },
        {
          "url": "https://git.kernel.org/stable/c/eca9bd215d2233de79d930fa97aefbce03247a98"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8abb0c3dc1e28454851a00f8b7333d9695d566c"
        }
      ],
      "title": "bpf: Fix crash due to incorrect copy_map_value",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48940",
    "datePublished": "2024-08-22T03:31:35.844Z",
    "dateReserved": "2024-08-22T01:27:53.623Z",
    "dateUpdated": "2026-08-05T08:53:01.254Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.