CVE-2022-50814
Integer Mismatch Causes Out-of-Bounds in Linux hisi_zip Crypto
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hisilicon | hisi_zip | * |
| hisi | hisi_zip | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a bug in the Linux kernel's hisilicon/zip crypto module where there is a mismatch in how the variable sgl_sge_nr is accessed. The variable sgl_sge_nr is of type u16, but it was being accessed using param_get/set_int functions, which are meant for a different data type. This mismatch caused a global out-of-bounds memory access detected by KASAN, leading to potential memory corruption. The fix involved replacing param_get/set_int with param_get/set_ushort to correctly handle the u16 type.
How can this vulnerability impact me? :
This vulnerability can lead to out-of-bounds memory access in the Linux kernel's hisilicon/zip crypto module, which may cause memory corruption or crashes. Such issues can potentially be exploited to compromise system stability or security, depending on the context in which the vulnerable code is used.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can be done by monitoring kernel logs for KASAN (Kernel Address Sanitizer) reports indicating a global-out-of-bounds error related to param_get_int and sgl_sge_nr in the hisi_zip module. For example, you can use the command 'dmesg | grep KASAN' or 'journalctl -k | grep KASAN' to look for such error messages.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version where the hisilicon/zip driver has been fixed by replacing param_get/set_int with param_get/set_ushort for the sgl_sge_nr variable. Until then, monitoring for KASAN errors and avoiding use of the affected hisi_zip functionality may reduce risk.