CVE-2022-50222
BaseFortify
Publication date: 2025-06-18
Last updated on: 2025-11-19
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in the Linux kernel involves an information leak in the virtual console subsystem (vcs_read()). After a resize operation, the unicode screen buffer was not properly initialized, allowing the buffer to be read immediately and potentially exposing sensitive kernel memory contents. The fix involved initializing the buffer using kzalloc() to clear its contents before use.
How can this vulnerability impact me? :
This vulnerability can lead to an information leak where sensitive data from kernel memory could be exposed to an unprivileged user reading from the virtual console device. This could potentially aid attackers in gathering information useful for further attacks or privilege escalation.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the system's Linux kernel is vulnerable to the infoleak at vcs_read() after a resize operation. The provided code snippet demonstrates a method to test the vulnerability by manipulating the framebuffer device and reading from /dev/vcsu. Running similar commands that open /dev/fb0 and /dev/vcsu, perform ioctl calls to change screen info, and then attempt to read the buffer can help detect the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is mitigated by updating the Linux kernel to a version where the unicode screen buffer is properly initialized using kzalloc(), preventing the infoleak. Therefore, the immediate step is to apply the kernel update or patch that includes this fix.