CVE-2022-50763
Unknown Unknown - Not Provided
Integer Overflow in Linux Kernel Marvell/Octeontx Crypto Component

Publication date: 2025-12-24

Last updated on: 2025-12-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - prevent integer overflows The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you can do to protect yourself. Still we try to limit the damage as much as possible. Also Smatch marks any data read from the filesystem as untrusted and prints warnings if it not capped correctly. The "code_length * 2" can overflow. The round_up(ucode_size, 16) + sizeof() expression can overflow too. Prevent these overflows.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-24
Last Modified
2025-12-24
Generated
2026-06-16
AI Q&A
2025-12-24
EPSS Evaluated
2026-06-15
NVD
CVE-2022-50763
EUVD
EUVD-2022-55798
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability involves integer overflows in the Linux kernel's marvell/octeontx crypto component. Specifically, the 'code_length' value, which comes from firmware files, can cause an overflow when multiplied by 2, and other expressions involving rounding up the microcode size can also overflow. These overflows could lead to improper handling of untrusted firmware data.

Impact Analysis

If the firmware is untrusted, integer overflows in processing the 'code_length' and related calculations could potentially lead to unexpected behavior or security issues in the kernel's crypto component. However, since the firmware is untrusted, there is limited protection possible, and the fix aims to limit the damage caused by these overflows.

Mitigation Strategies

Since the vulnerability involves integer overflows in the Linux kernel's marvell/octeontx crypto code related to untrusted firmware files, immediate mitigation steps include ensuring that your firmware is from a trusted source and applying any available kernel updates or patches that address this issue. Limiting the use of untrusted firmware and monitoring for kernel updates is recommended.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2022-50763. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart