QID 354327

a flaw was found in unrestricted ebpf usage by the bpf_btf_load, leading to a possible out-of-bounds memory write in the linux kernels bpf subsystem due to the way a user loads btf.
This flaw allows a local user to crash or escalate their privileges on the system. (
( CVE-2022-0500) a flaw was found in the linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem.
This flaw allows a local user to cause an out-of-bounds write issue. (
( CVE-2022-1015) a flaw was found in the linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free.
This issue needs to handle return with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker. (
( CVE-2022-1016) when the kvm updates the guests page table entry, it will first use get_user_pages_fast() to pin the page, and when it fails (e.g. the vma->flags has vm_io or vm_pfnmap), it will get corresponding vma where the page lies in through find_vma_intersection(), calculate the physical address, and map the page to the kernel virtual address through memremap(), and finally, write the update. the problem is that when we get the vma through find_vma_intersection(), only vm_pfnmap is checked, not both vm_io and vm_pfnmap.
In the reproducer below, after the kvm_set_user_memory_region is completed, we replace the guests memory mapping with the kernel-user shared region of io_uring and then perform the kvm_translate operation, which finally triggers the page table entry update.
Since both vaddr and vm_pgoff are controllable by the user-mode process, writing may exceed the previously mapped guest memory space and trigger exceptions such as uaf.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.