linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Use VM_MAP instead of VM_ALLOC for ringbuf...
CVE-2022-48714 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-48714, released June 20, 2024. It is not reported as exploited. Patch Radar priority: High.
In the Linux kernel, the following vulnerability has been resolved: bpf: Use VM_MAP instead of VM_ALLOC for ringbuf After commit 2fd3fb0be1d1 ("kasan, vmalloc: unpoison VM_ALLOC pages after mapping"), non-VM_ALLOC mappings will be marked as accessible in __get_vm_area_node() when KASAN is enabled. But now the flag for ringbuf area is VM_ALLOC, so KASAN will complain out-of-bound access after vmap() returns. Because the ringbuf area is created by mapping allocated pages, so use VM_MAP instead. After the change, info in /proc/vmallocinfo also changes from [start]-[end] 24576 ringbuf_map_alloc+0x171/0x290 vmalloc user to [start]-[end] 24576 ringbuf_map_alloc+0x171/0x290 vmap user
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| linux · Debian 12.15 (bookworm) | 5.16.10-1 | DEBIAN-CVE-2022-48714 | Jun 20, 2024 |
| linux · Debian 13.5 (trixie) | 5.16.10-1 | DEBIAN-CVE-2022-48714 | Jun 20, 2024 |
| linux · Debian 14 | 5.16.10-1 | DEBIAN-CVE-2022-48714 | Jun 20, 2024 |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.