CVE-2022-0433: Linux Kernel BPF Subsystem DOS Vulnerability

CVE-2022-0433 Overview

A NULL pointer dereference vulnerability was discovered in the Linux kernel's BPF subsystem affecting the bloom filter implementation. The flaw exists in the way a user triggers the map_get_next_key function of the BPF bloom filter, allowing a local attacker to crash the system and cause a denial of service condition.

Critical Impact

Local users can exploit this vulnerability to crash the Linux kernel, causing system-wide denial of service. This affects Linux kernel versions prior to 5.17-rc1.

Affected Products

• Linux Kernel (versions prior to 5.17-rc1)
• Fedora 35

Discovery Timeline

• 2022-03-10 - CVE-2022-0433 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0433

Vulnerability Analysis

This vulnerability is classified under CWE-476 (NULL Pointer Dereference) and CWE-908 (Use of Uninitialized Resource). The flaw resides in the Linux kernel's Berkeley Packet Filter (BPF) subsystem, specifically within the bloom filter map implementation. BPF bloom filters are probabilistic data structures used for efficient set membership testing in kernel networking and tracing operations.

The vulnerability occurs when the map_get_next_key function is called on a BPF bloom filter map type. Bloom filters, by design, do not support iteration over their keys because they store hashed values rather than actual keys. The implementation failed to properly handle this unsupported operation, leading to a NULL pointer dereference when a user attempts to invoke this function.

Root Cause

The root cause stems from the bloom filter map type lacking a proper implementation or validation for the map_get_next_key callback function. When this operation is requested on a bloom filter map, the kernel attempts to dereference a NULL function pointer or an uninitialized callback, resulting in a kernel panic. The bloom filter map type was introduced without ensuring all required map operation callbacks were properly defined or that unsupported operations returned appropriate error codes.

Attack Vector

The attack requires local access to the system with the ability to interact with the BPF subsystem. An attacker needs sufficient privileges to create BPF maps (typically requiring CAP_SYS_ADMIN or CAP_BPF capabilities, or access through unprivileged BPF if enabled). The exploitation sequence involves creating a BPF bloom filter map using the bpf() syscall and then invoking the BPF_MAP_GET_NEXT_KEY command on the created map. This triggers the NULL pointer dereference within the kernel, causing an immediate system crash.

The attack is relatively straightforward for users with appropriate permissions and does not require user interaction. While the impact is limited to availability (denial of service), it can be particularly disruptive in multi-tenant environments or containerized deployments where BPF access may be available to less-privileged users.

Detection Methods for CVE-2022-0433

Indicators of Compromise

• Kernel panic or system crash events with stack traces referencing BPF bloom filter operations or map_get_next_key
• Unexpected system reboots or kernel oops messages in /var/log/kern.log or dmesg output
• Audit logs showing BPF syscall activity followed by system instability

Detection Strategies

• Monitor for BPF-related kernel panics using crash dump analysis tools like kdump or crash
• Implement audit rules for BPF syscalls: auditctl -a always,exit -F arch=b64 -S bpf -k bpf_activity
• Deploy kernel security modules like SELinux or AppArmor to restrict BPF access to authorized users
• Use SentinelOne's kernel-level telemetry to detect anomalous BPF activity patterns

Monitoring Recommendations

• Enable kernel crash dump collection to capture forensic evidence of exploitation attempts
• Configure centralized logging for kernel messages to correlate potential attack patterns across infrastructure
• Monitor for processes attempting to create BPF maps with bloom filter type followed by iteration operations

How to Mitigate CVE-2022-0433

Immediate Actions Required

• Update the Linux kernel to version 5.17-rc1 or later, which contains the fix for this vulnerability
• If immediate patching is not possible, restrict BPF access using kernel configuration (CONFIG_BPF_UNPRIV_DEFAULT_OFF=y) or sysctl settings
• Review and limit user capabilities to prevent unauthorized BPF subsystem access

Patch Information

The vulnerability has been addressed in the upstream Linux kernel through commit 3ccdcee28415c4226de05438b4d89eb5514edf73. This fix ensures that the bloom filter map type properly handles the unsupported map_get_next_key operation by returning an appropriate error code instead of dereferencing a NULL pointer.

For detailed patch information, refer to the Kernel Git Commit Update and the Red Hat Bug Report.

Workarounds

• Disable unprivileged BPF access by setting kernel.unprivileged_bpf_disabled=1 via sysctl
• Remove CAP_BPF and CAP_SYS_ADMIN capabilities from untrusted users and processes
• Use container security policies to prevent BPF access from containerized workloads

# Disable unprivileged BPF access
sysctl -w kernel.unprivileged_bpf_disabled=1

# Make the setting persistent across reboots
echo "kernel.unprivileged_bpf_disabled=1" >> /etc/sysctl.conf