CVE-2022-50347
BaseFortify
Publication date: 2025-09-16
Last updated on: 2025-12-01
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 3.16 (inc) to 4.9.337 (exc) |
| linux | linux_kernel | From 4.10 (inc) to 4.14.303 (exc) |
| linux | linux_kernel | From 4.15 (inc) to 4.19.270 (exc) |
| linux | linux_kernel | From 4.20 (inc) to 5.4.229 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.163 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.86 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.0.16 (exc) |
| linux | linux_kernel | From 6.1 (inc) to 6.1.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-476 | The product dereferences a pointer that it expects to be valid but is NULL. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can cause a kernel crash due to memory leaks and improper device removal in the Linux kernel's MMC driver. Such crashes can lead to system instability, potential denial of service, and loss of data or availability on affected systems.
Can you explain this vulnerability to me?
This vulnerability occurs in the Linux kernel's mmc subsystem, specifically in the rtsx_usb_sdmmc driver. The function mmc_add_host() may return an error, but if its return value is ignored, the memory allocated by mmc_alloc_host() is leaked. This leads to a kernel crash because the system attempts to delete a device that was never properly added during the removal process. The fix involves properly checking the return value of mmc_add_host() and freeing allocated memory in the error path, as well as calling led_classdev_unregister() and pm_runtime_disable().
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the Linux kernel to a version where the issue with mmc_add_host() return value checking in the rtsx_usb_sdmmc driver is fixed. This fix ensures proper error handling by checking the return value of mmc_add_host(), freeing allocated memory with mmc_free_host() on error, and properly calling led_classdev_unregister() and pm_runtime_disable() in the remove path to prevent kernel crashes.