Linux kernel bpf x86: erroneous free of a non-finalized bpf_prog_pack frees a whole 2MB JIT page

CVSS 7.8CVE-2022-50168Kernel, userspace & hypervisorcurated

Impact

When a BPF program with multiple subprograms fails to JIT, jit_subprogs() can call bpf_jit_free() on subprograms that never went through bpf_jit_binary_pack_finalize(), and bpf_jit_binary_pack_free() then releases the entire shared 2MB executable page - memory still holding other programs' JITed code. Reported by syzbot. The consequence is corruption of executable kernel memory shared across unrelated BPF programs, which is as bad as it sounds on a node where BPF is everywhere: CNI datapaths (Cilium), observability agents, seccomp and GPU telemetry all load programs. A GPU node is not drainable cheaply, and this is a crash-or-worse in memory that is executable by definition. The fix adds a custom x86_64 bpf_jit_free() that finalizes first.

Who can reach it

Local: a user able to load BPF programs - root, or an unprivileged user/pod holding CAP_BPF or with unprivileged BPF enabled. Not reachable over the network. On clusters that let tenant workloads load BPF, any such pod is in range.

What to do

Apply the stable kernel fix (commits 1d5f82d9dd47 / 60e66074812d / f91ce608a79c) and reboot the node; the JIT lives in the core kernel, so there is no module reload. Interim mitigation: set kernel.unprivileged_bpf_disabled=1 and withhold CAP_BPF from tenant workloads so only trusted agents can load programs.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-50168 https://git.kernel.org/stable/c/1d5f82d9dd477d5c66e0214a68c3e4f308eadd6d https://git.kernel.org/stable/c/60e66074812dde9cde3d99cdd3caa9e40f1a4516 https://git.kernel.org/stable/c/f91ce608a79c0db3e72bd63c23e011a9ebc31505

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.