Stack Overflow Vulnerability in Linux Kernel - CVE-2022-50407
Summary
CVE-2022-50407: In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - increase the memory of local variables Increase the buffer to prevent stack overflow by fuzz test. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, managing system resources and enabling communication between hardware and software. It is widely used in various environments, from servers to embedded systems. This vulnerability affects the kernel's crypto subsystem, specifically in the hisilicon/qm module, which is responsible for handling quality of service (QoS) configurations. The vulnerability arises from insufficient buffer size for local variables, making it susceptible to stack overflow attacks.
Vulnerability Detail
CVE-2022-50407 is a vulnerability in the Linux kernel's crypto subsystem, specifically within the hisilicon/qm module. The issue stems from an inadequate buffer size for the 'val buffer', which is only 32 bytes, while the maximum length of the QoS configuration buffer is 256 bytes. This discrepancy allows for potential stack overflow when the sscanf function does not validate the destination memory length. If exploited, this vulnerability could lead to arbitrary code execution or system crashes, compromising the integrity and availability of the system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, consider limiting the input size for the QoS configuration to prevent overflow until the package can be updated. This can be done by implementing input validation checks in the application that interacts with the kernel's crypto subsystem.
Conclusion
CVE-2022-50407 is a critical vulnerability in the Linux kernel that poses significant risks due to stack overflow potential. It is crucial to update to the patched version to mitigate these risks. Users should also consider implementing workarounds until they can apply the necessary updates.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50407 is a vulnerability in the Linux kernel that can lead to stack overflow due to insufficient buffer size in the hisilicon/qm module.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to arbitrary code execution or system crashes, affecting the integrity and availability of the system.
Yes, the patched version of the Linux package is 6.1.4-1 for Debian 12, 13, and 14.
If immediate updates are not possible, implement input validation checks to limit the size of QoS configuration inputs as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
