CVE-2022-49030

libbpf: Handle size overflow for ringbuf mmap

State
Published
Severity
7.8 High
Published
Oct 21, 2024
Updated
Aug 5, 2026
Reserved
Aug 22, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

libbpf: Handle size overflow for ringbuf mmap

The maximum size of ringbuf is 2GB on x86-64 host, so 2 * max_entries will overflow u32 when mapping producer page and data pages. Only casting max_entries to size_t is not enough, because for 32-bits application on 64-bits kernel the size of read-only mmap region also could overflow size_t.

So fixing it by casting the size of read-only mmap region into a __u64 and checking whether or not there will be overflow during mmap.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • bf99c936f9478a05d51e9f101f90de70bee9a89c to before 8a549ab6724520aa3c07f47e0eba820293551490Affected
  • bf99c936f9478a05d51e9f101f90de70bee9a89c to before 0140e079a42064680394fff1199a7b5483688decAffected
  • bf99c936f9478a05d51e9f101f90de70bee9a89c to before 535a25ab4f9a45f74ba38ab71de95e97474922edAffected
  • bf99c936f9478a05d51e9f101f90de70bee9a89c to before 927cbb478adf917e0a142b94baa37f06279cc466Affected
LinuxLinux
  • 5.8Affected
  • before 5.8Not affected
  • 5.10.158 through 5.10.*Not affected
  • 5.15.82 through 5.15.*Not affected
  • 6.0.12 through 6.0.*Not affected
  • 6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.