CVE-2022-50394
BaseFortify
Publication date: 2025-09-18
Last updated on: 2025-12-12
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 3.9 (inc) to 4.9.337 (exc) |
| linux | linux_kernel | From 4.10 (inc) to 4.14.303 (exc) |
| linux | linux_kernel | From 4.15 (inc) to 4.19.270 (exc) |
| linux | linux_kernel | From 4.20 (inc) to 5.4.229 (exc) |
| linux | linux_kernel | From 5.5 (inc) to 5.10.163 (exc) |
| linux | linux_kernel | From 5.11 (inc) to 5.15.86 (exc) |
| linux | linux_kernel | From 5.16 (inc) to 6.0.16 (exc) |
| linux | linux_kernel | From 6.1 (inc) to 6.1.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an out-of-bounds bug in the Linux kernel's i2c ismt driver, specifically in the ismt_access() function. It occurs because the driver does not properly check the size of the data provided by the user, allowing a very large value in 'data->block[0]' to cause an out-of-bounds memory access. This can lead to kernel memory corruption or crashes.
How can this vulnerability impact me? :
The vulnerability can cause out-of-bounds memory access in the kernel, potentially leading to system instability, crashes, or security issues such as privilege escalation or denial of service if exploited.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking the system logs for specific kernel messages indicating an out-of-bounds bug in the ismt_access() function. Look for log entries similar to: '[ 33.996995] BUG: KASAN: out-of-bounds in ismt_access.cold' or related traces involving 'ismt_smbus' and 'i2c'. You can use the command 'dmesg | grep -i ismt' or 'journalctl -k | grep -i ismt' to search for these messages in kernel logs.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the Linux kernel to a version where this vulnerability is fixed, which includes the check on the size of 'data->block[0]' in the ismt driver. Until then, avoid using or exposing the vulnerable i2c ismt driver functionality to untrusted users or processes to prevent exploitation.