CVE-2022-50066
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-11-17
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-129 | The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an out-of-bounds array index error in the Linux kernel's atlantic network driver. Specifically, a for loop updates an index beyond the valid range of the aq_vec array without checking bounds, leading to a potential array index out of range error and unsafe dereference.
How can this vulnerability impact me? :
The impact of this vulnerability could include kernel instability or crashes due to accessing invalid memory locations. This may affect system reliability or network functionality on affected hardware using the atlantic driver.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring kernel logs for out-of-bounds array index errors related to the atlantic driver. Specifically, look for messages similar to: "UBSAN: array-index-out-of-bounds in drivers/net/ethernet/aquantia/atlantic/aq_nic.c". You can use the command 'dmesg | grep -i atlantic' or 'journalctl -k | grep -i atlantic' to check for such errors in the kernel logs.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where this vulnerability is fixed. Since the issue is due to an out-of-range array index in the atlantic driver, applying the patch or upgrading to a kernel version that includes the fix will resolve the problem. In the meantime, you may consider disabling the atlantic network driver if feasible to prevent triggering the vulnerability.