CVE-2022-50657

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2025-12-09

Last updated on: 2025-12-09

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: riscv: mm: add missing memcpy in kasan_init Hi Atish, It seems that the panic is due to the missing memcpy during kasan_init. Could you please check whether this patch is helpful? When doing kasan_populate, the new allocated base_pud/base_p4d should contain kasan_early_shadow_{pud, p4d}'s content. Add the missing memcpy to avoid page fault when read/write kasan shadow region. Tested on: - qemu with sv57 and CONFIG_KASAN on. - qemu with sv48 and CONFIG_KASAN on.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-09

Last Modified

2025-12-09

Generated

2026-07-06

AI Q&A

2025-12-10

EPSS Evaluated

2026-07-05

NVD

CVE-2022-50657

EUVD

EUVD-2022-55748

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Mitigation Strategies

Apply the patch that adds the missing memcpy in kasan_init to ensure that the kasan shadow region is properly initialized and to avoid page faults during kasan_populate. This involves updating the Linux kernel to a version that includes this fix.

Executive Summary

This vulnerability in the Linux kernel involves a missing memcpy operation during the kasan_init process for riscv architectures. Specifically, when kasan_populate allocates new base_pud/base_p4d structures, it should copy the content of kasan_early_shadow_{pud, p4d} to avoid page faults when accessing the kasan shadow region. The missing memcpy could cause a kernel panic due to page faults when reading or writing to this shadow memory.

Impact Analysis

This vulnerability can cause the Linux kernel to panic (crash) on riscv architectures when Kernel Address Sanitizer (KASAN) is enabled, due to page faults in the kasan shadow memory region. This could lead to system instability or downtime.

Hi! I’m here to help you understand CVE-2022-50657. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70