CVE-2022-48998: Vulnerability in Linux Linux

Severity: mediumType: vulnerabilityCVE-2022-48998

In the Linux kernel, the following vulnerability has been resolved: powerpc/bpf/32: Fix Oops on tail call tests test_bpf tail call tests end up as: test_bpf: #0 Tail call leaf jited:1 85 PASS test_bpf: #1 Tail call 2 jited:1 111 PASS test_bpf: #2 Tail call 3 jited:1 145 PASS test_bpf: #3 Tail call 4 jited:1 170 PASS test_bpf: #4 Tail call load/store leaf jited:1 190 PASS test_bpf: #5 Tail call load/store jited:1 BUG: Unable to handle kernel data access on write at 0xf1b4e000 Faulting instruction address: 0xbe86b710 Oops: Kernel access of bad area, sig: 11 [#1] BE PAGE_SIZE=4K MMU=Hash PowerMac Modules linked in: test_bpf(+) CPU: 0 PID: 97 Comm: insmod Not tainted 6.1.0-rc4+ #195 Hardware name: PowerMac3,1 750CL 0x87210 PowerMac NIP: be86b710 LR: be857e88 CTR: be86b704 REGS: f1b4df20 TRAP: 0300 Not tainted (6.1.0-rc4+) MSR: 00009032 <EE,ME,IR,DR,RI> CR: 28008242 XER: 00000000 DAR: f1b4e000 DSISR: 42000000 GPR00: 00000001 f1b4dfe0 c11d2280 00000000 00000000 00000000 00000002 00000000 GPR08: f1b4e000 be86b704 f1b4e000 00000000 00000000 100d816a f2440000 fe73baa8 GPR16: f2458000 00000000 c1941ae4 f1fe2248 00000045 c0de0000 f2458030 00000000 GPR24: 000003e8 0000000f f2458000 f1b4dc90 3e584b46 00000000 f24466a0 c1941a00 NIP [be86b710] 0xbe86b710 LR [be857e88] __run_one+0xec/0x264 [test_bpf] Call Trace: [f1b4dfe0] [00000002] 0x2 (unreliable) Instruction dump: XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX ---[ end trace 0000000000000000 ]--- This is a tentative to write above the stack. The problem is encoutered with tests added by commit 38608ee7b690 ("bpf, tests: Add load store test case for tail call") This happens because tail call is done to a BPF prog with a different stack_depth. At the time being, the stack is kept as is when the caller tail calls its callee. But at exit, the callee restores the stack based on its own properties. Therefore here, at each run, r1 is erroneously increased by 32 - 16 = 16 bytes. This was done that way in order to pass the tail call count from caller to callee through the stack. As powerpc32 doesn't have a red zone in the stack, it was necessary the maintain the stack as is for the tail call. But it was not anticipated that the BPF frame size could be different. Let's take a new approach. Use register r4 to carry the tail call count during the tail call, and save it into the stack at function entry if required. This means the input parameter must be in r3, which is more correct as it is a 32 bits parameter, then tail call better match with normal BPF function entry, the down side being that we move that input parameter back and forth between r3 and r4. That can be optimised later. Doing that also has the advantage of maximising the common parts between tail calls and a normal function exit. With the fix, tail call tests are now successfull: test_bpf: #0 Tail call leaf jited:1 53 PASS test_bpf: #1 Tail call 2 jited:1 115 PASS test_bpf: #2 Tail call 3 jited:1 154 PASS test_bpf: #3 Tail call 4 jited:1 165 PASS test_bpf: #4 Tail call load/store leaf jited:1 101 PASS test_bpf: #5 Tail call load/store jited:1 141 PASS test_bpf: #6 Tail call error path, max count reached jited:1 994 PASS test_bpf: #7 Tail call count preserved across function calls jited:1 140975 PASS test_bpf: #8 Tail call error path, NULL target jited:1 110 PASS test_bpf: #9 Tail call error path, index out of range jited:1 69 PASS test_bpf: test_tail_calls: Summary: 10 PASSED, 0 FAILED, [10/10 JIT'ed]

AI Analysis

Technical Summary

CVE-2022-48998 is a vulnerability identified in the Linux kernel specifically affecting the PowerPC 32-bit architecture's implementation of eBPF (extended Berkeley Packet Filter) tail calls. The issue arises from improper stack management during tail calls between BPF programs with differing stack depths. In the vulnerable code, the stack pointer (register r1) is erroneously incremented due to the callee restoring the stack based on its own frame size rather than maintaining the caller's stack frame. This leads to an attempt to write beyond the allocated stack boundary, causing a kernel oops (crash) due to invalid memory access. The problem was introduced with a commit adding load/store test cases for tail calls and manifests during specific test scenarios where tail calls are chained. The root cause is that the PowerPC32 architecture lacks a red zone on the stack, so the stack must be preserved exactly during tail calls, but the existing implementation did not account for different BPF frame sizes between caller and callee. The fix involves changing the mechanism to pass the tail call count via register r4 instead of the stack, aligning the tail call behavior more closely with normal BPF function entry conventions. This correction prevents stack corruption and stabilizes tail call execution. The vulnerability is specific to PowerPC 32-bit Linux kernels and affects kernel versions around 6.1.0-rc4+ where the problematic commit was introduced. No known exploits are reported in the wild, and the issue is primarily a stability and reliability problem causing kernel crashes rather than direct code execution or privilege escalation. However, kernel crashes can lead to denial of service conditions and potential disruption of critical systems relying on affected kernels.

Potential Impact

For European organizations, the primary impact of CVE-2022-48998 is the risk of denial of service (DoS) due to kernel crashes on systems running vulnerable PowerPC 32-bit Linux kernels with eBPF tail call functionality. While PowerPC architectures are less common than x86_64 in Europe, they are still used in specialized embedded systems, industrial control systems, and legacy infrastructure in sectors such as manufacturing, telecommunications, and research institutions. A kernel oops triggered by this vulnerability can cause system instability, unexpected reboots, or service interruptions, potentially affecting availability of critical services. Since the vulnerability does not enable privilege escalation or arbitrary code execution, confidentiality and integrity impacts are limited. However, disruption of availability in critical infrastructure or embedded devices could have cascading operational effects. European organizations relying on PowerPC-based Linux systems should be aware of this vulnerability to avoid unexpected downtime. The lack of known exploits reduces immediate risk, but the vulnerability should be addressed proactively to maintain system reliability.

Mitigation Recommendations

1. Apply official Linux kernel patches that address CVE-2022-48998 as soon as they become available from trusted sources or Linux distribution vendors. Monitor kernel updates closely for PowerPC 32-bit platforms. 2. For organizations using custom or embedded Linux kernels on PowerPC hardware, backport the fix or upgrade to a kernel version including the patch to prevent kernel crashes. 3. Disable or restrict eBPF tail call functionality on vulnerable systems if patching is not immediately feasible, especially in environments where stability is critical. 4. Implement robust monitoring and alerting for kernel oops and system crashes to detect potential exploitation or triggering of this vulnerability. 5. Conduct thorough testing of kernel updates in staging environments to ensure stability and compatibility before deployment in production. 6. Maintain an inventory of PowerPC 32-bit Linux systems within the organization to prioritize patching and mitigation efforts. 7. Collaborate with hardware and software vendors to ensure timely updates and support for affected platforms.