{
  "cveId": "CVE-2022-49658",
  "url": "https://patchblox.com/security/cve/CVE-2022-49658",
  "summary": "CVE-2022-49658 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-49658, released February 26, 2025. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  bpf: Fix insufficient bounds propagation from ad...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals  Kuee reported a corner case where the tnum becomes constant after the call to __reg_bound_offset(), but the register\u0027s bounds are not, that is, its min bounds are still not equal to the register\u0027s max bounds.  This in turn allows to leak pointers through turning a pointer register as is into an unknown scalar via adjust_ptr_min_max_vals().  Before:    func#0 @0   0: R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))   0: (b7) r0 = 1                        ; R0_w=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0))   1: (b7) r3 = 0                        ; R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0))   2: (87) r3 = -r3                      ; R3_w=scalar()   3: (87) r3 = -r3                      ; R3_w=scalar()   4: (47) r3 |= 32767                   ; R3_w=scalar(smin=-9223372036854743041,umin=32767,var_off=(0x7fff; 0xffffffffffff8000),s32_min=-2147450881)   5: (75) if r3 s\u003E= 0x0 goto pc\u002B1       ; R3_w=scalar(umin=9223372036854808575,var_off=(0x8000000000007fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)   6: (95) exit    from 5 to 7: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))   7: (d5) if r3 s\u003C= 0x8000 goto pc\u002B1    ; R3=scalar(umin=32769,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)   8: (95) exit    from 7 to 9: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=32768,var_off=(0x7fff; 0x8000)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))   9: (07) r3 \u002B= -32767                  ; R3_w=scalar(imm=0,umax=1,var_off=(0x0; 0x0))  \u003C--- [*]   10: (95) exit  What can be seen here is that R3=scalar(umin=32767,umax=32768,var_off=(0x7fff; 0x8000)) after the operation R3 \u002B= -32767 results in a \u0027malformed\u0027 constant, that is, R3_w=scalar(imm=0,umax=1,var_off=(0x0; 0x0)). Intersecting with var_off has not been done at that point via __update_reg_bounds(), which would have improved the umax to be equal to umin.  Refactor the tnum \u003C\u003E min/max bounds information flow into a reg_bounds_sync() helper and use it consistently everywhere. After the fix, bounds have been corrected to R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0)) and thus the register is regarded as a \u0027proper\u0027 constant scalar of 0.  After:    func#0 @0   0: R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))   0: (b7) r0 = 1                        ; R0_w=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0))   1: (b7) r3 = 0                        ; R3_w=scalar(imm=0,umax=0,var_off=(0x0; 0x0))   2: (87) r3 = -r3                      ; R3_w=scalar()   3: (87) r3 = -r3                      ; R3_w=scalar()   4: (47) r3 |= 32767                   ; R3_w=scalar(smin=-9223372036854743041,umin=32767,var_off=(0x7fff; 0xffffffffffff8000),s32_min=-2147450881)   5: (75) if r3 s\u003E= 0x0 goto pc\u002B1       ; R3_w=scalar(umin=9223372036854808575,var_off=(0x8000000000007fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)   6: (95) exit    from 5 to 7: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881) R10=fp(off=0,imm=0,umax=0,var_off=(0x0; 0x0))   7: (d5) if r3 s\u003C= 0x8000 goto pc\u002B1    ; R3=scalar(umin=32769,umax=9223372036854775807,var_off=(0x7fff; 0x7fffffffffff8000),s32_min=-2147450881,u32_min=32767)   8: (95) exit    from 7 to 9: R0=scalar(imm=1,umin=1,umax=1,var_off=(0x1; 0x0)) R1=ctx(off=0,imm=0,umax=0,var_off=(0x0; 0x0)) R3=scalar(umin=32767,umax=32768,var_off=(0x7fff; 0x8000)) R10=fp(off=0 ---truncated---",
  "published": "2025-02-26T07:01:40Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00281,
  "epssPercentile": 0.20671,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "5.18.14-1",
      "fix": "DEBIAN-CVE-2022-49658",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49658",
      "released": "2025-02-26T07:01:40Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "5.18.14-1",
      "fix": "DEBIAN-CVE-2022-49658",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49658",
      "released": "2025-02-26T07:01:40Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "5.18.14-1",
      "fix": "DEBIAN-CVE-2022-49658",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2022-49658",
      "released": "2025-02-26T07:01:40Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}