CVE-2022-50650 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2022-50650 Interim 1 1 2025-12-23T02:23:45Z current 2025-12-23T02:23:45Z 2025-12-23T02:23:45Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2022-50650 In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference state management for synchronous callbacks Currently, verifier verifies callback functions (sync and async) as if they will be executed once, (i.e. it explores execution state as if the function was being called once). The next insn to explore is set to start of subprog and the exit from nested frame is handled using curframe > 0 and prepare_func_exit. In case of async callback it uses a customized variant of push_stack simulating a kind of branch to set up custom state and execution context for the async callback. While this approach is simple and works when callback really will be executed only once, it is unsafe for all of our current helpers which are for_each style, i.e. they execute the callback multiple times. A callback releasing acquired references of the caller may do so multiple times, but currently verifier sees it as one call inside the frame, which then returns to caller. Hence, it thinks it released some reference that the cb e.g. got access through callback_ctx (register filled inside cb from spilled typed register on stack). Similarly, it may see that an acquire call is unpaired inside the callback, so the caller will copy the reference state of callback and then will have to release the register with new ref_obj_ids. But again, the callback may execute multiple times, but the verifier will only account for acquired references for a single symbolic execution of the callback, which will cause leaks. Note that for async callback case, things are different. While currently we have bpf_timer_set_callback which only executes it once, even for multiple executions it would be safe, as reference state is NULL and check_reference_leak would force program to release state before BPF_EXIT. The state is also unaffected by analysis for the caller frame. Hence async callback is safe. Since we want the reference state to be accessible, e.g. for pointers loaded from stack through callback_ctx's PTR_TO_STACK, we still have to copy caller's reference_state to callback's bpf_func_state, but we enforce that whatever references it adds to that reference_state has been released before it hits BPF_EXIT. This requires introducing a new callback_ref member in the reference state to distinguish between caller vs callee references. Hence, check_reference_leak now errors out if it sees we are in callback_fn and we have not released callback_ref refs. Since there can be multiple nested callbacks, like frame 0 -> cb1 -> cb2 etc. we need to also distinguish between whether this particular ref belongs to this callback frame or parent, and only error for our own, so we store state->frameno (which is always non-zero for callbacks). In short, callbacks can read parent reference_state, but cannot mutate it, to be able to use pointers acquired by the caller. They must only undo their changes (by releasing their own acquired_refs before BPF_EXIT) on top of caller reference_state before returning (at which point the caller and callback state will match anyway, so no need to copy it back to caller). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings SLES-LTSS-TERADATA 15 SP2 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Workstation Extension 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 SUSE Linux Enterprise High Availability Extension 15 SP7 SUSE Linux Enterprise High Availability Extension 16.0 SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Legacy 15 SP6 SUSE Linux Enterprise Module for Public Cloud 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Module for Legacy 15 SP7 SUSE Linux Enterprise Module for Public Cloud 15 SP7 SUSE Linux Enterprise Live Patching 12 SP5 SUSE Linux Enterprise Live Patching 15 SP3 SUSE Linux Enterprise Live Patching 15 SP4 SUSE Linux Enterprise Live Patching 15 SP5 SUSE Linux Enterprise Live Patching 15 SP6 SUSE Linux Enterprise Live Patching 15 SP7 SUSE Linux Enterprise Micro 5.0 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro 5.5 SUSE Real Time Module 15 SP6 SUSE Real Time Module 15 SP7 SUSE Linux Enterprise Server 11 SP4 LTSS SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE SUSE Linux Enterprise Server 12 SP2-LTSS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5-LTSS SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Server 15 SP3-LTSS SUSE Linux Enterprise Server 15 SP4-LTSS SUSE Linux Enterprise Server 15 SP5-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Legacy 15 SP6 SUSE Linux Enterprise Module for Public Cloud 15 SP6 SUSE Linux Enterprise Workstation Extension 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Module for Legacy 15 SP7 SUSE Linux Enterprise Module for Public Cloud 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server Teradata 12 SP3 SUSE Linux Enterprise Server Teradata 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP5 SUSE Linux Enterprise Module for Basesystem 15 SP6 SUSE Linux Enterprise Module for Development Tools 15 SP6 SUSE Linux Enterprise Module for Legacy 15 SP6 SUSE Linux Enterprise Module for Public Cloud 15 SP6 SUSE Linux Enterprise Workstation Extension 15 SP6 SUSE Linux Enterprise Module for Basesystem 15 SP7 SUSE Linux Enterprise Module for Development Tools 15 SP7 SUSE Linux Enterprise Module for Legacy 15 SP7 SUSE Linux Enterprise Module for Public Cloud 15 SP7 SUSE Linux Enterprise Workstation Extension 15 SP7 SUSE Linux Micro 6.0 SUSE Linux Micro 6.1 SUSE Manager Proxy LTS 4.3 SUSE Manager Retail Branch Server LTS 4.3 SUSE Manager Server LTS 4.3 openSUSE Leap 15.6 cluster-md-kmp-default dlm-kmp-default gfs2-kmp-default kernel-default kernel-default-base kernel-default-devel kernel-default-extra kernel-default-kgraft kernel-default-kgraft-devel kernel-default-livepatch kernel-default-livepatch-devel kernel-default-man kernel-default-optional kernel-default-vdso kernel-devel kernel-devel-azure kernel-devel-rt kernel-macros kernel-rt kernel-source kernel-source-azure kernel-source-rt kernel-source-vanilla kselftests-kmp-default ocfs2-kmp-default reiserfs-kmp-default kernel-default as a component of SLES-LTSS-TERADATA 15 SP2 kernel-source as a component of SLES-LTSS-TERADATA 15 SP2 cluster-md-kmp-default as a component of SUSE Linux Enterprise High Availability Extension 15 SP7 dlm-kmp-default as a component of SUSE Linux Enterprise High Availability Extension 15 SP7 gfs2-kmp-default as a component of SUSE Linux Enterprise High Availability Extension 15 SP7 ocfs2-kmp-default as a component of SUSE Linux Enterprise High Availability Extension 15 SP7 kernel-default as a component of SUSE Linux Enterprise High Availability Extension 15 SP7 kernel-source as a component of SUSE Linux Enterprise High Availability Extension 15 SP7 kernel-default as a component of SUSE Linux Enterprise High Availability Extension 16.0 kernel-source as a component of SUSE Linux Enterprise High Availability Extension 16.0 kernel-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-default-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-macros as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-source as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS kernel-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kernel-default-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kernel-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kernel-macros as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS kernel-source as a component of SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS cluster-md-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS dlm-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS gfs2-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-default-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS ocfs2-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-macros as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS kernel-source as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS cluster-md-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS dlm-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS gfs2-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-default-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS ocfs2-kmp-default as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-devel as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-macros as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-source as a component of SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS kernel-default-kgraft as a component of SUSE Linux Enterprise Live Patching 12 SP5 kernel-default-kgraft-devel as a component of SUSE Linux Enterprise Live Patching 12 SP5 kernel-default as a component of SUSE Linux Enterprise Live Patching 12 SP5 kernel-source as a component of SUSE Linux Enterprise Live Patching 12 SP5 kernel-default-livepatch as a component of SUSE Linux Enterprise Live Patching 15 SP3 kernel-default-livepatch-devel as a component of SUSE Linux Enterprise Live Patching 15 SP3 kernel-default as a component of SUSE Linux Enterprise Live Patching 15 SP3 kernel-source as a component of SUSE Linux Enterprise Live Patching 15 SP3 kernel-default-livepatch as a component of SUSE Linux Enterprise Live Patching 15 SP4 kernel-default-livepatch-devel as a component of SUSE Linux Enterprise Live Patching 15 SP4 kernel-default as a component of SUSE Linux Enterprise Live Patching 15 SP4 kernel-source as a component of SUSE Linux Enterprise Live Patching 15 SP4 kernel-default-livepatch as a component of SUSE Linux Enterprise Live Patching 15 SP5 kernel-default-livepatch-devel as a component of SUSE Linux Enterprise Live Patching 15 SP5 kernel-default as a component of SUSE Linux Enterprise Live Patching 15 SP5 kernel-source as a component of SUSE Linux Enterprise Live Patching 15 SP5 kernel-default-livepatch as a component of SUSE Linux Enterprise Live Patching 15 SP6 kernel-default-livepatch-devel as a component of SUSE Linux Enterprise Live Patching 15 SP6 kernel-default as a component of SUSE Linux Enterprise Live Patching 15 SP6 kernel-source as a component of SUSE Linux Enterprise Live Patching 15 SP6 kernel-default-livepatch as a component of SUSE Linux Enterprise Live Patching 15 SP7 kernel-default-livepatch-devel as a component of SUSE Linux Enterprise Live Patching 15 SP7 kernel-default as a component of SUSE Linux Enterprise Live Patching 15 SP7 kernel-source as a component of SUSE Linux Enterprise Live Patching 15 SP7 kernel-default as a component of SUSE Linux Enterprise Micro 5.0 kernel-default as a component of SUSE Linux Enterprise Micro 5.1 kernel-rt as a component of SUSE Linux Enterprise Micro 5.1 kernel-default as a component of SUSE Linux Enterprise Micro 5.2 kernel-rt as a component of SUSE Linux Enterprise Micro 5.2 kernel-source as a component of SUSE Linux Enterprise Micro 5.2 kernel-source-rt as a component of SUSE Linux Enterprise Micro 5.2 kernel-default as a component of SUSE Linux Enterprise Micro 5.3 kernel-rt as a component of SUSE Linux Enterprise Micro 5.3 kernel-source as a component of SUSE Linux Enterprise Micro 5.3 kernel-source-rt as a component of SUSE Linux Enterprise Micro 5.3 kernel-default as a component of SUSE Linux Enterprise Micro 5.4 kernel-rt as a component of SUSE Linux Enterprise Micro 5.4 kernel-source as a component of SUSE Linux Enterprise Micro 5.4 kernel-source-rt as a component of SUSE Linux Enterprise Micro 5.4 kernel-default as a component of SUSE Linux Enterprise Micro 5.5 kernel-macros as a component of SUSE Linux Enterprise Micro 5.5 kernel-source as a component of SUSE Linux Enterprise Micro 5.5 kernel-devel-rt as a component of SUSE Linux Enterprise Micro 5.5 kernel-source-rt as a component of SUSE Linux Enterprise Micro 5.5 kernel-default as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 kernel-default-devel as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 kernel-devel as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 kernel-macros as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 kernel-source as a component of SUSE Linux Enterprise Module for Basesystem 15 SP6 kernel-default as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 kernel-default-devel as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 kernel-devel as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 kernel-macros as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 kernel-source as a component of SUSE Linux Enterprise Module for Basesystem 15 SP7 kernel-default as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 kernel-source as a component of SUSE Linux Enterprise Module for Development Tools 15 SP6 kernel-default as a component of SUSE Linux Enterprise Module for Development Tools 15 SP7 kernel-source as a component of SUSE Linux Enterprise Module for Development Tools 15 SP7 reiserfs-kmp-default as a component of SUSE Linux Enterprise Module for Legacy 15 SP6 kernel-default as a component of SUSE Linux Enterprise Module for Legacy 15 SP6 kernel-source as a component of SUSE Linux Enterprise Module for Legacy 15 SP6 reiserfs-kmp-default as a component of SUSE Linux Enterprise Module for Legacy 15 SP7 kernel-default as a component of SUSE Linux Enterprise Module for Legacy 15 SP7 kernel-source as a component of SUSE Linux Enterprise Module for Legacy 15 SP7 kernel-devel-azure as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP6 kernel-source-azure as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP6 kernel-devel-azure as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP7 kernel-source-azure as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP7 kernel-default as a component of SUSE Linux Enterprise Server 11 SP4 LTSS kernel-source as a component of SUSE Linux Enterprise Server 11 SP4 LTSS kernel-default as a component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE kernel-default-base as a component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE kernel-default-devel as a component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE kernel-source as a component of SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE kernel-default as a component of SUSE Linux Enterprise Server 12 SP2-LTSS kernel-default-base as a component of SUSE Linux Enterprise Server 12 SP2-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 12 SP2-LTSS kernel-default-man as a component of SUSE Linux Enterprise Server 12 SP2-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 12 SP2-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 12 SP2-LTSS kernel-source as a component of SUSE Linux Enterprise Server 12 SP2-LTSS kernel-default as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-default-base as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-default-man as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 12 SP4-LTSS kernel-source as a component of SUSE Linux Enterprise Server 12 SP4-LTSS cluster-md-kmp-default as a component of SUSE Linux Enterprise Server 12 SP5-LTSS dlm-kmp-default as a component of SUSE Linux Enterprise Server 12 SP5-LTSS gfs2-kmp-default as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-default as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-default-base as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-default-man as a component of SUSE Linux Enterprise Server 12 SP5-LTSS ocfs2-kmp-default as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-source as a component of SUSE Linux Enterprise Server 12 SP5-LTSS kernel-default as a component of SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security kernel-source as a component of SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security kernel-default as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-default-base as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-default-man as a component of SUSE Linux Enterprise Server 15 SP1-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15 SP1-LTSS kernel-default as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15 SP2-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15 SP2-LTSS kernel-default as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15 SP3-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15 SP3-LTSS kernel-default as a component of SUSE Linux Enterprise Server 15 SP4-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15 SP4-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15 SP4-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15 SP4-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15 SP4-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15 SP4-LTSS cluster-md-kmp-default as a component of SUSE Linux Enterprise Server 15 SP5-LTSS dlm-kmp-default as a component of SUSE Linux Enterprise Server 15 SP5-LTSS gfs2-kmp-default as a component of SUSE Linux Enterprise Server 15 SP5-LTSS kernel-default as a component of SUSE Linux Enterprise Server 15 SP5-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15 SP5-LTSS ocfs2-kmp-default as a component of SUSE Linux Enterprise Server 15 SP5-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15 SP5-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15 SP5-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15 SP5-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15 SP5-LTSS kernel-default as a component of SUSE Linux Enterprise Server 15-LTSS kernel-default-base as a component of SUSE Linux Enterprise Server 15-LTSS kernel-default-devel as a component of SUSE Linux Enterprise Server 15-LTSS kernel-default-man as a component of SUSE Linux Enterprise Server 15-LTSS reiserfs-kmp-default as a component of SUSE Linux Enterprise Server 15-LTSS kernel-devel as a component of SUSE Linux Enterprise Server 15-LTSS kernel-macros as a component of SUSE Linux Enterprise Server 15-LTSS kernel-source as a component of SUSE Linux Enterprise Server 15-LTSS kernel-default as a component of SUSE Linux Enterprise Server Teradata 12 SP3 kernel-source as a component of SUSE Linux Enterprise Server Teradata 12 SP3 kernel-default as a component of SUSE Linux Enterprise Server Teradata 15 SP4 kernel-source as a component of SUSE Linux Enterprise Server Teradata 15 SP4 kernel-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 kernel-default-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 reiserfs-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 kernel-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 kernel-macros as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 kernel-source as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 kernel-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 kernel-default-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 reiserfs-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 kernel-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 kernel-macros as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 kernel-source as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP4 cluster-md-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 dlm-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 gfs2-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 kernel-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 kernel-default-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 ocfs2-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 reiserfs-kmp-default as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 kernel-devel as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 kernel-macros as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 kernel-source as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP5 kernel-default-extra as a component of SUSE Linux Enterprise Workstation Extension 15 SP6 kernel-default as a component of SUSE Linux Enterprise Workstation Extension 15 SP6 kernel-source as a component of SUSE Linux Enterprise Workstation Extension 15 SP6 kernel-default-extra as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 kernel-default as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 kernel-source as a component of SUSE Linux Enterprise Workstation Extension 15 SP7 kernel-default as a component of SUSE Linux Micro 6.0 kernel-devel as a component of SUSE Linux Micro 6.0 kernel-macros as a component of SUSE Linux Micro 6.0 kernel-source as a component of SUSE Linux Micro 6.0 kernel-devel-rt as a component of SUSE Linux Micro 6.0 kernel-source-rt as a component of SUSE Linux Micro 6.0 kernel-default as a component of SUSE Linux Micro 6.1 kernel-devel as a component of SUSE Linux Micro 6.1 kernel-macros as a component of SUSE Linux Micro 6.1 kernel-source as a component of SUSE Linux Micro 6.1 kernel-devel-rt as a component of SUSE Linux Micro 6.1 kernel-source-rt as a component of SUSE Linux Micro 6.1 kernel-default as a component of SUSE Manager Proxy LTS 4.3 kernel-default-devel as a component of SUSE Manager Proxy LTS 4.3 kernel-devel as a component of SUSE Manager Proxy LTS 4.3 kernel-macros as a component of SUSE Manager Proxy LTS 4.3 kernel-source as a component of SUSE Manager Proxy LTS 4.3 kernel-default as a component of SUSE Manager Retail Branch Server LTS 4.3 kernel-default-devel as a component of SUSE Manager Retail Branch Server LTS 4.3 kernel-devel as a component of SUSE Manager Retail Branch Server LTS 4.3 kernel-macros as a component of SUSE Manager Retail Branch Server LTS 4.3 kernel-source as a component of SUSE Manager Retail Branch Server LTS 4.3 kernel-default as a component of SUSE Manager Server LTS 4.3 kernel-default-devel as a component of SUSE Manager Server LTS 4.3 kernel-devel as a component of SUSE Manager Server LTS 4.3 kernel-macros as a component of SUSE Manager Server LTS 4.3 kernel-source as a component of SUSE Manager Server LTS 4.3 kernel-devel-rt as a component of SUSE Real Time Module 15 SP6 kernel-source-rt as a component of SUSE Real Time Module 15 SP6 kernel-devel-rt as a component of SUSE Real Time Module 15 SP7 kernel-source-rt as a component of SUSE Real Time Module 15 SP7 cluster-md-kmp-default as a component of openSUSE Leap 15.6 dlm-kmp-default as a component of openSUSE Leap 15.6 gfs2-kmp-default as a component of openSUSE Leap 15.6 kernel-default as a component of openSUSE Leap 15.6 kernel-default-devel as a component of openSUSE Leap 15.6 kernel-default-extra as a component of openSUSE Leap 15.6 kernel-default-livepatch as a component of openSUSE Leap 15.6 kernel-default-livepatch-devel as a component of openSUSE Leap 15.6 kernel-default-optional as a component of openSUSE Leap 15.6 kernel-default-vdso as a component of openSUSE Leap 15.6 kselftests-kmp-default as a component of openSUSE Leap 15.6 ocfs2-kmp-default as a component of openSUSE Leap 15.6 reiserfs-kmp-default as a component of openSUSE Leap 15.6 kernel-devel as a component of openSUSE Leap 15.6 kernel-macros as a component of openSUSE Leap 15.6 kernel-source as a component of openSUSE Leap 15.6 kernel-source-vanilla as a component of openSUSE Leap 15.6 kernel-devel-azure as a component of openSUSE Leap 15.6 kernel-source-azure as a component of openSUSE Leap 15.6 kernel-devel-rt as a component of openSUSE Leap 15.6 kernel-source-rt as a component of openSUSE Leap 15.6 In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference state management for synchronous callbacks Currently, verifier verifies callback functions (sync and async) as if they will be executed once, (i.e. it explores execution state as if the function was being called once). The next insn to explore is set to start of subprog and the exit from nested frame is handled using curframe > 0 and prepare_func_exit. In case of async callback it uses a customized variant of push_stack simulating a kind of branch to set up custom state and execution context for the async callback. While this approach is simple and works when callback really will be executed only once, it is unsafe for all of our current helpers which are for_each style, i.e. they execute the callback multiple times. A callback releasing acquired references of the caller may do so multiple times, but currently verifier sees it as one call inside the frame, which then returns to caller. Hence, it thinks it released some reference that the cb e.g. got access through callback_ctx (register filled inside cb from spilled typed register on stack). Similarly, it may see that an acquire call is unpaired inside the callback, so the caller will copy the reference state of callback and then will have to release the register with new ref_obj_ids. But again, the callback may execute multiple times, but the verifier will only account for acquired references for a single symbolic execution of the callback, which will cause leaks. Note that for async callback case, things are different. While currently we have bpf_timer_set_callback which only executes it once, even for multiple executions it would be safe, as reference state is NULL and check_reference_leak would force program to release state before BPF_EXIT. The state is also unaffected by analysis for the caller frame. Hence async callback is safe. Since we want the reference state to be accessible, e.g. for pointers loaded from stack through callback_ctx's PTR_TO_STACK, we still have to copy caller's reference_state to callback's bpf_func_state, but we enforce that whatever references it adds to that reference_state has been released before it hits BPF_EXIT. This requires introducing a new callback_ref member in the reference state to distinguish between caller vs callee references. Hence, check_reference_leak now errors out if it sees we are in callback_fn and we have not released callback_ref refs. Since there can be multiple nested callbacks, like frame 0 -> cb1 -> cb2 etc. we need to also distinguish between whether this particular ref belongs to this callback frame or parent, and only error for our own, so we store state->frameno (which is always non-zero for callbacks). In short, callbacks can read parent reference_state, but cannot mutate it, to be able to use pointers acquired by the caller. They must only undo their changes (by releasing their own acquired_refs before BPF_EXIT) on top of caller reference_state before returning (at which point the caller and callback state will match anyway, so no need to copy it back to caller). CVE-2022-50650 SLES-LTSS-TERADATA 15 SP2:kernel-default SLES-LTSS-TERADATA 15 SP2:kernel-source SUSE Linux Enterprise High Availability Extension 15 SP7:cluster-md-kmp-default SUSE Linux Enterprise High Availability Extension 15 SP7:dlm-kmp-default SUSE Linux Enterprise High Availability Extension 15 SP7:gfs2-kmp-default SUSE Linux Enterprise High Availability Extension 15 SP7:kernel-default SUSE Linux Enterprise High Availability Extension 15 SP7:kernel-source SUSE Linux Enterprise High Availability Extension 15 SP7:ocfs2-kmp-default SUSE Linux Enterprise High Availability Extension 16.0:kernel-default SUSE Linux Enterprise High Availability Extension 16.0:kernel-source SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:kernel-default SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:kernel-default-devel SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:kernel-devel SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:kernel-macros SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:kernel-source SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Live Patching 12 SP5:kernel-default SUSE Linux Enterprise Live Patching 12 SP5:kernel-default-kgraft SUSE Linux Enterprise Live Patching 12 SP5:kernel-default-kgraft-devel SUSE Linux Enterprise Live Patching 12 SP5:kernel-source SUSE Linux Enterprise Live Patching 15 SP3:kernel-default SUSE Linux Enterprise Live Patching 15 SP3:kernel-default-livepatch SUSE Linux Enterprise Live Patching 15 SP3:kernel-default-livepatch-devel SUSE Linux Enterprise Live Patching 15 SP3:kernel-source SUSE Linux Enterprise Live Patching 15 SP6:kernel-default SUSE Linux Enterprise Live Patching 15 SP6:kernel-default-livepatch SUSE Linux Enterprise Live Patching 15 SP6:kernel-default-livepatch-devel SUSE Linux Enterprise Live Patching 15 SP6:kernel-source SUSE Linux Enterprise Live Patching 15 SP7:kernel-default SUSE Linux Enterprise Live Patching 15 SP7:kernel-default-livepatch SUSE Linux Enterprise Live Patching 15 SP7:kernel-default-livepatch-devel SUSE Linux Enterprise Live Patching 15 SP7:kernel-source SUSE Linux Enterprise Micro 5.0:kernel-default SUSE Linux Enterprise Micro 5.1:kernel-default SUSE Linux Enterprise Micro 5.1:kernel-rt SUSE Linux Enterprise Micro 5.2:kernel-default SUSE Linux Enterprise Micro 5.2:kernel-rt SUSE Linux Enterprise Micro 5.2:kernel-source SUSE Linux Enterprise Micro 5.2:kernel-source-rt SUSE Linux Enterprise Module for Basesystem 15 SP6:kernel-default SUSE Linux Enterprise Module for Basesystem 15 SP6:kernel-default-devel SUSE Linux Enterprise Module for Basesystem 15 SP6:kernel-devel SUSE Linux Enterprise Module for Basesystem 15 SP6:kernel-macros SUSE Linux Enterprise Module for Basesystem 15 SP6:kernel-source SUSE Linux Enterprise Module for Basesystem 15 SP7:kernel-default SUSE Linux Enterprise Module for Basesystem 15 SP7:kernel-default-devel SUSE Linux Enterprise Module for Basesystem 15 SP7:kernel-devel SUSE Linux Enterprise Module for Basesystem 15 SP7:kernel-macros SUSE Linux Enterprise Module for Basesystem 15 SP7:kernel-source SUSE Linux Enterprise Module for Development Tools 15 SP6:kernel-default SUSE Linux Enterprise Module for Development Tools 15 SP6:kernel-source SUSE Linux Enterprise Module for Development Tools 15 SP7:kernel-default SUSE Linux Enterprise Module for Development Tools 15 SP7:kernel-source SUSE Linux Enterprise Module for Legacy 15 SP6:kernel-default SUSE Linux Enterprise Module for Legacy 15 SP6:kernel-source SUSE Linux Enterprise Module for Legacy 15 SP6:reiserfs-kmp-default SUSE Linux Enterprise Module for Legacy 15 SP7:kernel-default SUSE Linux Enterprise Module for Legacy 15 SP7:kernel-source SUSE Linux Enterprise Module for Legacy 15 SP7:reiserfs-kmp-default SUSE Linux Enterprise Module for Public Cloud 15 SP6:kernel-devel-azure SUSE Linux Enterprise Module for Public Cloud 15 SP6:kernel-source-azure SUSE Linux Enterprise Module for Public Cloud 15 SP7:kernel-devel-azure SUSE Linux Enterprise Module for Public Cloud 15 SP7:kernel-source-azure SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE:kernel-default SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE:kernel-default-base SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE:kernel-default-devel SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME CORE:kernel-source SUSE Linux Enterprise Server 11 SP4 LTSS:kernel-default SUSE Linux Enterprise Server 11 SP4 LTSS:kernel-source SUSE Linux Enterprise Server 12 SP2-LTSS:kernel-default SUSE Linux Enterprise Server 12 SP2-LTSS:kernel-default-base SUSE Linux Enterprise Server 12 SP2-LTSS:kernel-default-devel SUSE Linux Enterprise Server 12 SP2-LTSS:kernel-default-man SUSE Linux Enterprise Server 12 SP2-LTSS:kernel-devel SUSE Linux Enterprise Server 12 SP2-LTSS:kernel-macros SUSE Linux Enterprise Server 12 SP2-LTSS:kernel-source SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-default SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-default-base SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-default-devel SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-default-man SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-devel SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-macros SUSE Linux Enterprise Server 12 SP4-LTSS:kernel-source SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security:kernel-default SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security:kernel-source SUSE Linux Enterprise Server 12 SP5-LTSS:cluster-md-kmp-default SUSE Linux Enterprise Server 12 SP5-LTSS:dlm-kmp-default SUSE Linux Enterprise Server 12 SP5-LTSS:gfs2-kmp-default SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-base SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-devel SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-default-man SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-devel SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-macros SUSE Linux Enterprise Server 12 SP5-LTSS:kernel-source SUSE Linux Enterprise Server 12 SP5-LTSS:ocfs2-kmp-default SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-default SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-default-base SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-default-devel SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-default-man SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-devel SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-macros SUSE Linux Enterprise Server 15 SP1-LTSS:kernel-source SUSE Linux Enterprise Server 15 SP1-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Server 15 SP2-LTSS:kernel-default SUSE Linux Enterprise Server 15 SP2-LTSS:kernel-default-devel SUSE Linux Enterprise Server 15 SP2-LTSS:kernel-devel SUSE Linux Enterprise Server 15 SP2-LTSS:kernel-macros SUSE Linux Enterprise Server 15 SP2-LTSS:kernel-source SUSE Linux Enterprise Server 15 SP2-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Server 15 SP3-LTSS:kernel-default SUSE Linux Enterprise Server 15 SP3-LTSS:kernel-default-devel SUSE Linux Enterprise Server 15 SP3-LTSS:kernel-devel SUSE Linux Enterprise Server 15 SP3-LTSS:kernel-macros SUSE Linux Enterprise Server 15 SP3-LTSS:kernel-source SUSE Linux Enterprise Server 15 SP3-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Server 15-LTSS:kernel-default SUSE Linux Enterprise Server 15-LTSS:kernel-default-base SUSE Linux Enterprise Server 15-LTSS:kernel-default-devel SUSE Linux Enterprise Server 15-LTSS:kernel-default-man SUSE Linux Enterprise Server 15-LTSS:kernel-devel SUSE Linux Enterprise Server 15-LTSS:kernel-macros SUSE Linux Enterprise Server 15-LTSS:kernel-source SUSE Linux Enterprise Server 15-LTSS:reiserfs-kmp-default SUSE Linux Enterprise Server Teradata 12 SP3:kernel-default SUSE Linux Enterprise Server Teradata 12 SP3:kernel-source SUSE Linux Enterprise Server for SAP Applications 15 SP3:kernel-default SUSE Linux Enterprise Server for SAP Applications 15 SP3:kernel-default-devel SUSE Linux Enterprise Server for SAP Applications 15 SP3:kernel-devel SUSE Linux Enterprise Server for SAP Applications 15 SP3:kernel-macros SUSE Linux Enterprise Server for SAP Applications 15 SP3:kernel-source SUSE Linux Enterprise Server for SAP Applications 15 SP3:reiserfs-kmp-default SUSE Linux Enterprise Workstation Extension 15 SP6:kernel-default SUSE Linux Enterprise Workstation Extension 15 SP6:kernel-default-extra SUSE Linux Enterprise Workstation Extension 15 SP6:kernel-source SUSE Linux Enterprise Workstation Extension 15 SP7:kernel-default SUSE Linux Enterprise Workstation Extension 15 SP7:kernel-default-extra SUSE Linux Enterprise Workstation Extension 15 SP7:kernel-source SUSE Linux Micro 6.0:kernel-default SUSE Linux Micro 6.0:kernel-devel SUSE Linux Micro 6.0:kernel-devel-rt SUSE Linux Micro 6.0:kernel-macros SUSE Linux Micro 6.0:kernel-source SUSE Linux Micro 6.0:kernel-source-rt SUSE Linux Micro 6.1:kernel-default SUSE Linux Micro 6.1:kernel-devel SUSE Linux Micro 6.1:kernel-devel-rt SUSE Linux Micro 6.1:kernel-macros SUSE Linux Micro 6.1:kernel-source SUSE Linux Micro 6.1:kernel-source-rt SUSE Real Time Module 15 SP6:kernel-devel-rt SUSE Real Time Module 15 SP6:kernel-source-rt SUSE Real Time Module 15 SP7:kernel-devel-rt SUSE Real Time Module 15 SP7:kernel-source-rt openSUSE Leap 15.6:cluster-md-kmp-default openSUSE Leap 15.6:dlm-kmp-default openSUSE Leap 15.6:gfs2-kmp-default openSUSE Leap 15.6:kernel-default openSUSE Leap 15.6:kernel-default-devel openSUSE Leap 15.6:kernel-default-extra openSUSE Leap 15.6:kernel-default-livepatch openSUSE Leap 15.6:kernel-default-livepatch-devel openSUSE Leap 15.6:kernel-default-optional openSUSE Leap 15.6:kernel-default-vdso openSUSE Leap 15.6:kernel-devel openSUSE Leap 15.6:kernel-devel-azure openSUSE Leap 15.6:kernel-devel-rt openSUSE Leap 15.6:kernel-macros openSUSE Leap 15.6:kernel-source openSUSE Leap 15.6:kernel-source-azure openSUSE Leap 15.6:kernel-source-rt openSUSE Leap 15.6:kernel-source-vanilla openSUSE Leap 15.6:kselftests-kmp-default openSUSE Leap 15.6:ocfs2-kmp-default openSUSE Leap 15.6:reiserfs-kmp-default moderate 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H