CVE-2022-50219

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. When detaching BPF links under memory allocation failure conditions, an already freed pointer is mistakenly retained on the control group list. A local attacker can exploit this use-after-free flaw during subsequent operations to cause a kernel crash, resulting in a Denial of Service (DoS).

A moderate-severity use-after-free flaw was found in the Linux kernel BPF (Berkeley Packet Filter) subsystem's compute_effective_progs(). When a cgroup BPF link is detached and a memory allocation inside update_effective_progs() fails, a pointer to the already freed bpf_cgroup_link is restored on the cgroup list; every subsequent call to update_effective_progs() then dereferences this deallocated pointer in prog_list_length(), triggering the use-after-free. A local attacker with the ability to attach and detach BPF links can exploit this flaw to crash the kernel, resulting in a denial of service. Red Hat Enterprise Linux 8 and 9 (kernel and kernel-rt) and Hosted OpenShift clusters (ARO 4 and OSD 4) are affected, and the fix is currently deferred for these streams; the residual risk while the fix is deferred is limited to a local user causing a system crash (denial of service) through this path. Red Hat Enterprise Linux 6, 7, and 10, and Red Hat In-Vehicle OS are not affected because the vulnerable code is not present in those products. Red Hat rates this flaw as Moderate (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because the flaw has availability impact only, leading to a kernel crash rather than loss of confidentiality or integrity; this is lower than the NIST/CVE.org score of 7.8 (High), which assumes complete confidentiality, integrity, and availability impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.