CVE-2022-49548

Summary

CVE-2022-49548 is a vulnerability affecting the Linux kernel. It involves an array overflow issue in the function bpf_trampoline_get_progs(). The vulnerability occurs due to the fact that the cnt value used in a check for the maximum number of programs does not account for BPF_TRAMP_MODIFY_RETURN bpf programs. Consequently, the number of attached BPF_TRAMP_MODIFY_RETURN bpf programs in a trampoline can exceed BPF_MAX_TRAMP_PROGS. This leads to an assignment causing an overflow in the progs array, as the progs field in the bpf_tramp_progs struct can only hold a maximum number of bpf programs.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.