{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.2",
    "cveMetadata": {
        "cveId": "CVE-2022-48998",
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "state": "PUBLISHED",
        "assignerShortName": "Linux",
        "dateReserved": "2024-08-22T01:27:53.637Z",
        "datePublished": "2024-10-21T20:06:13.440Z",
        "dateUpdated": "2026-08-05T08:53:21.648Z"
    },
    "containers": {
        "cna": {
            "providerMetadata": {
                "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
                "shortName": "Linux",
                "dateUpdated": "2026-08-05T08:53:21.648Z"
            },
            "descriptions": [
                {
                    "lang": "en",
                    "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/bpf/32: Fix Oops on tail call tests\n\ntest_bpf tail call tests end up as:\n\n  test_bpf: #0 Tail call leaf jited:1 85 PASS\n  test_bpf: #1 Tail call 2 jited:1 111 PASS\n  test_bpf: #2 Tail call 3 jited:1 145 PASS\n  test_bpf: #3 Tail call 4 jited:1 170 PASS\n  test_bpf: #4 Tail call load/store leaf jited:1 190 PASS\n  test_bpf: #5 Tail call load/store jited:1\n  BUG: Unable to handle kernel data access on write at 0xf1b4e000\n  Faulting instruction address: 0xbe86b710\n  Oops: Kernel access of bad area, sig: 11 [#1]\n  BE PAGE_SIZE=4K MMU=Hash PowerMac\n  Modules linked in: test_bpf(+)\n  CPU: 0 PID: 97 Comm: insmod Not tainted 6.1.0-rc4+ #195\n  Hardware name: PowerMac3,1 750CL 0x87210 PowerMac\n  NIP:  be86b710 LR: be857e88 CTR: be86b704\n  REGS: f1b4df20 TRAP: 0300   Not tainted  (6.1.0-rc4+)\n  MSR:  00009032 <EE,ME,IR,DR,RI>  CR: 28008242  XER: 00000000\n  DAR: f1b4e000 DSISR: 42000000\n  GPR00: 00000001 f1b4dfe0 c11d2280 00000000 00000000 00000000 00000002 00000000\n  GPR08: f1b4e000 be86b704 f1b4e000 00000000 00000000 100d816a f2440000 fe73baa8\n  GPR16: f2458000 00000000 c1941ae4 f1fe2248 00000045 c0de0000 f2458030 00000000\n  GPR24: 000003e8 0000000f f2458000 f1b4dc90 3e584b46 00000000 f24466a0 c1941a00\n  NIP [be86b710] 0xbe86b710\n  LR [be857e88] __run_one+0xec/0x264 [test_bpf]\n  Call Trace:\n  [f1b4dfe0] [00000002] 0x2 (unreliable)\n  Instruction dump:\n  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n  XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX\n  ---[ end trace 0000000000000000 ]---\n\nThis is a tentative to write above the stack. The problem is encoutered\nwith tests added by commit 38608ee7b690 (\"bpf, tests: Add load store\ntest case for tail call\")\n\nThis happens because tail call is done to a BPF prog with a different\nstack_depth. At the time being, the stack is kept as is when the caller\ntail calls its callee. But at exit, the callee restores the stack based\non its own properties. Therefore here, at each run, r1 is erroneously\nincreased by 32 - 16 = 16 bytes.\n\nThis was done that way in order to pass the tail call count from caller\nto callee through the stack. As powerpc32 doesn't have a red zone in\nthe stack, it was necessary the maintain the stack as is for the tail\ncall. But it was not anticipated that the BPF frame size could be\ndifferent.\n\nLet's take a new approach. Use register r4 to carry the tail call count\nduring the tail call, and save it into the stack at function entry if\nrequired. This means the input parameter must be in r3, which is more\ncorrect as it is a 32 bits parameter, then tail call better match with\nnormal BPF function entry, the down side being that we move that input\nparameter back and forth between r3 and r4. That can be optimised later.\n\nDoing that also has the advantage of maximising the common parts between\ntail calls and a normal function exit.\n\nWith the fix, tail call tests are now successfull:\n\n  test_bpf: #0 Tail call leaf jited:1 53 PASS\n  test_bpf: #1 Tail call 2 jited:1 115 PASS\n  test_bpf: #2 Tail call 3 jited:1 154 PASS\n  test_bpf: #3 Tail call 4 jited:1 165 PASS\n  test_bpf: #4 Tail call load/store leaf jited:1 101 PASS\n  test_bpf: #5 Tail call load/store jited:1 141 PASS\n  test_bpf: #6 Tail call error path, max count reached jited:1 994 PASS\n  test_bpf: #7 Tail call count preserved across function calls jited:1 140975 PASS\n  test_bpf: #8 Tail call error path, NULL target jited:1 110 PASS\n  test_bpf: #9 Tail call error path, index out of range jited:1 69 PASS\n  test_bpf: test_tail_calls: Summary: 10 PASSED, 0 FAILED, [10/10 JIT'ed]"
                }
            ],
            "metrics": [
                {
                    "cvssV3_1": {
                        "version": "3.1",
                        "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                        "baseScore": 7.8,
                        "baseSeverity": "HIGH"
                    },
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "AV:L - The bug is in the powerpc32 eBPF JIT and is reached by loading and running BPF programs (e.g. SOCKET_FILTER with prog_array tail calls) via the local bpf() syscall, not by processing remote network input.\nAC:L - An attacker fully controls both BPF programs' stack depths, the prog_array linkage, and when the programs run, so the stack-pointer skew and resulting out-of-bounds write are reliably triggerable with no conditions outside their control.\nPR:L - On systems with unprivileged BPF enabled, a normal local user can load SOCKET_FILTER programs that use bpf_tail_call and PROG_ARRAY maps; even where CAP_BPF is required, that is still low (non-admin) privilege under CVSS, not full root.\nUI:N - The attacker loads the malicious BPF programs and triggers execution themselves; no separate victim action is required.\nS:U - Successful exploitation corrupts the host kernel's own stack and authority (local privilege escalation); it does not cross a VM, IOMMU, or other distinct security boundary.\nC:H - Kernel stack corruption from a controlled stack-pointer skew is memory corruption that can be leveraged for arbitrary read primitives (e.g. by overwriting pointers/return state), so confidentiality impact is High.\nI:H - The bug is an attacker-controlled out-of-bounds write above the kernel stack (CWE-787) via mismatched BPF frame teardown on tail call, enabling stack corruption and control-flow hijacking.\nA:H - The vulnerability produces a reproducible kernel Oops/bad-area write on the affected path, which is a full availability impact (kernel crash)."
                        }
                    ]
                }
            ],
            "affected": [
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "unaffected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "arch/powerpc/net/bpf_jit_comp32.c"
                    ],
                    "versions": [
                        {
                            "version": "51c66ad849a703d9bbfd7704c941827aed0fd9fd",
                            "lessThan": "747a6e547240baaaf41874d27333b87b87cfd24c",
                            "status": "affected",
                            "versionType": "git"
                        },
                        {
                            "version": "51c66ad849a703d9bbfd7704c941827aed0fd9fd",
                            "lessThan": "89d21e259a94f7d5582ec675aa445f5a79f347e4",
                            "status": "affected",
                            "versionType": "git"
                        }
                    ]
                },
                {
                    "product": "Linux",
                    "vendor": "Linux",
                    "defaultStatus": "affected",
                    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                    "programFiles": [
                        "arch/powerpc/net/bpf_jit_comp32.c"
                    ],
                    "versions": [
                        {
                            "version": "5.13",
                            "status": "affected"
                        },
                        {
                            "version": "0",
                            "lessThan": "5.13",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.0.12",
                            "lessThanOrEqual": "6.0.*",
                            "status": "unaffected",
                            "versionType": "semver"
                        },
                        {
                            "version": "6.1",
                            "lessThanOrEqual": "*",
                            "status": "unaffected",
                            "versionType": "original_commit_for_fix"
                        }
                    ]
                }
            ],
            "cpeApplicability": [
                {
                    "nodes": [
                        {
                            "operator": "OR",
                            "negate": false,
                            "cpeMatch": [
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.13",
                                    "versionEndExcluding": "6.0.12"
                                },
                                {
                                    "vulnerable": true,
                                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                                    "versionStartIncluding": "5.13",
                                    "versionEndExcluding": "6.1"
                                }
                            ]
                        }
                    ]
                }
            ],
            "references": [
                {
                    "url": "https://git.kernel.org/stable/c/747a6e547240baaaf41874d27333b87b87cfd24c"
                },
                {
                    "url": "https://git.kernel.org/stable/c/89d21e259a94f7d5582ec675aa445f5a79f347e4"
                }
            ],
            "title": "powerpc/bpf/32: Fix Oops on tail call tests",
            "x_generator": {
                "engine": "bippy-1.2.0"
            }
        },
        "adp": [
            {
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "id": "CVE-2022-48998",
                                "role": "CISA Coordinator",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "version": "2.0.3",
                                "timestamp": "2024-10-22T13:15:34.218660Z"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2024-10-22T13:18:41.122Z"
                }
            }
        ]
    }
}