Linux kernel bpf: 32-bit overflow computing element address in BPF arrays larger than 4GB

CVSS 5.5CVE-2022-50167Kernel, userspace & hypervisorcurated

Impact

Element address calculation in BPF array maps multiplied two u32 values (index and element size), so a map larger than 4GB wrapped the offset and produced a pointer outside the intended allocation. The fix forces 64-bit multiplication everywhere, including explicit casts in the speculation-barrier index_mask path. Operators who run large eBPF-based observability or networking agents on GPU nodes are the ones who can hit this, since only very large maps are affected; the consequence is kernel memory accessed at a wrong address, recorded as an availability impact. Exposure is limited to code that can create a multi-gigabyte array map, which requires BPF privileges.

Who can reach it

Local, authenticated: a process with BPF map-creation rights (CAP_BPF/CAP_SYS_ADMIN) that allocates an array map over 4GB. Not reachable from an unprivileged tenant pod.

What to do

Update to a stable kernel carrying the fix for your series (commits in the record). Kernel update means draining the node and rebooting; no runtime mitigation beyond avoiding >4GB BPF array maps.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-50167 https://git.kernel.org/stable/c/87ac0d600943994444e24382a87aa19acc4cd3d4 https://git.kernel.org/stable/c/063e092534d4c6785228e5b1eb6e9329f66ccbe4

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.