« Volver al listado

CVE-2022-50674

Estado: AplazadaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

riscv: vdso: fix NULL deference in vdso_join_timens() when vfork

Testing tools/testing/selftests/timens/vfork_exec.c got below kernel log:

This is because the mm->context.vdso_info is NULL in vfork case. From another side, mm->context.vdso_info either points to vdso info for RV64 or vdso info for compat, there's no need to bloat riscv's mm_context_t, we can handle the difference when setup the additional page for vdso.

Detalles técnicos trazas, registros y código del informe original
[    6.838454] Unable to handle kernel access to user memory without uaccess routines at virtual address 0000000000000020
[    6.842255] Oops [#1]
[    6.842871] Modules linked in:
[    6.844249] CPU: 1 PID: 64 Comm: vfork_exec Not tainted 6.0.0-rc3-rt15+ #8
[    6.845861] Hardware name: riscv-virtio,qemu (DT)
[    6.848009] epc : vdso_join_timens+0xd2/0x110
[    6.850097]  ra : vdso_join_timens+0xd2/0x110
[    6.851164] epc : ffffffff8000635c ra : ffffffff8000635c sp : ff6000000181fbf0
[    6.852562]  gp : ffffffff80cff648 tp : ff60000000fdb700 t0 : 3030303030303030
[    6.853852]  t1 : 0000000000000030 t2 : 3030303030303030 s0 : ff6000000181fc40
[    6.854984]  s1 : ff60000001e6c000 a0 : 0000000000000010 a1 : ffffffff8005654c
[    6.856221]  a2 : 00000000ffffefff a3 : 0000000000000000 a4 : 0000000000000000
[    6.858114]  a5 : 0000000000000000 a6 : 0000000000000008 a7 : 0000000000000038
[    6.859484]  s2 : ff60000001e6c068 s3 : ff6000000108abb0 s4 : 0000000000000000
[    6.860751]  s5 : 0000000000001000 s6 : ffffffff8089dc40 s7 : ffffffff8089dc38
[    6.862029]  s8 : ffffffff8089dc30 s9 : ff60000000fdbe38 s10: 000000000000005e
[    6.863304]  s11: ffffffff80cc3510 t3 : ffffffff80d1112f t4 : ffffffff80d1112f
[    6.864565]  t5 : ffffffff80d11130 t6 : ff6000000181fa00
[    6.865561] status: 0000000000000120 badaddr: 0000000000000020 cause: 000000000000000d
[    6.868046] [<ffffffff8008dc94>] timens_commit+0x38/0x11a
[    6.869089] [<ffffffff8008dde8>] timens_on_fork+0x72/0xb4
[    6.870055] [<ffffffff80190096>] begin_new_exec+0x3c6/0x9f0
[    6.871231] [<ffffffff801d826c>] load_elf_binary+0x628/0x1214
[    6.872304] [<ffffffff8018ee7a>] bprm_execve+0x1f2/0x4e4
[    6.873243] [<ffffffff8018f90c>] do_execveat_common+0x16e/0x1ee
[    6.874258] [<ffffffff8018f9c8>] sys_execve+0x3c/0x48
[    6.875162] [<ffffffff80003556>] ret_from_syscall+0x0/0x2
[    6.877484] ---[ end trace 0000000000000000 ]---

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-50674",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3092eb45637573c5e435fbf5eaf9516316e5f9c6",
              "lessThan": "df30c4feba51beeb138f3518c2421abc8cbda3c1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3092eb45637573c5e435fbf5eaf9516316e5f9c6",
              "lessThan": "f2419a6fbb4caf8cf3fe0ac7e4cf2e28127d04b4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3092eb45637573c5e435fbf5eaf9516316e5f9c6",
              "lessThan": "a8616d2dc193b6becc36b5f3cfeaa9ac7a5762f9",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "arch/riscv/include/asm/mmu.h",
            "arch/riscv/kernel/vdso.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.19",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver",
              "lessThanOrEqual": "5.19.*"
            },
            {
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.*"
            },
            {
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "arch/riscv/include/asm/mmu.h",
            "arch/riscv/kernel/vdso.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-09T16:17:19.610",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/a8616d2dc193b6becc36b5f3cfeaa9ac7a5762f9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/df30c4feba51beeb138f3518c2421abc8cbda3c1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f2419a6fbb4caf8cf3fe0ac7e4cf2e28127d04b4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nriscv: vdso: fix NULL deference in vdso_join_timens() when vfork\n\nTesting tools/testing/selftests/timens/vfork_exec.c got below\nkernel log:\n\n[    6.838454] Unable to handle kernel access to user memory without uaccess routines at virtual address 0000000000000020\n[    6.842255] Oops [#1]\n[    6.842871] Modules linked in:\n[    6.844249] CPU: 1 PID: 64 Comm: vfork_exec Not tainted 6.0.0-rc3-rt15+ #8\n[    6.845861] Hardware name: riscv-virtio,qemu (DT)\n[    6.848009] epc : vdso_join_timens+0xd2/0x110\n[    6.850097]  ra : vdso_join_timens+0xd2/0x110\n[    6.851164] epc : ffffffff8000635c ra : ffffffff8000635c sp : ff6000000181fbf0\n[    6.852562]  gp : ffffffff80cff648 tp : ff60000000fdb700 t0 : 3030303030303030\n[    6.853852]  t1 : 0000000000000030 t2 : 3030303030303030 s0 : ff6000000181fc40\n[    6.854984]  s1 : ff60000001e6c000 a0 : 0000000000000010 a1 : ffffffff8005654c\n[    6.856221]  a2 : 00000000ffffefff a3 : 0000000000000000 a4 : 0000000000000000\n[    6.858114]  a5 : 0000000000000000 a6 : 0000000000000008 a7 : 0000000000000038\n[    6.859484]  s2 : ff60000001e6c068 s3 : ff6000000108abb0 s4 : 0000000000000000\n[    6.860751]  s5 : 0000000000001000 s6 : ffffffff8089dc40 s7 : ffffffff8089dc38\n[    6.862029]  s8 : ffffffff8089dc30 s9 : ff60000000fdbe38 s10: 000000000000005e\n[    6.863304]  s11: ffffffff80cc3510 t3 : ffffffff80d1112f t4 : ffffffff80d1112f\n[    6.864565]  t5 : ffffffff80d11130 t6 : ff6000000181fa00\n[    6.865561] status: 0000000000000120 badaddr: 0000000000000020 cause: 000000000000000d\n[    6.868046] [<ffffffff8008dc94>] timens_commit+0x38/0x11a\n[    6.869089] [<ffffffff8008dde8>] timens_on_fork+0x72/0xb4\n[    6.870055] [<ffffffff80190096>] begin_new_exec+0x3c6/0x9f0\n[    6.871231] [<ffffffff801d826c>] load_elf_binary+0x628/0x1214\n[    6.872304] [<ffffffff8018ee7a>] bprm_execve+0x1f2/0x4e4\n[    6.873243] [<ffffffff8018f90c>] do_execveat_common+0x16e/0x1ee\n[    6.874258] [<ffffffff8018f9c8>] sys_execve+0x3c/0x48\n[    6.875162] [<ffffffff80003556>] ret_from_syscall+0x0/0x2\n[    6.877484] ---[ end trace 0000000000000000 ]---\n\nThis is because the mm->context.vdso_info is NULL in vfork case. From\nanother side, mm->context.vdso_info either points to vdso info\nfor RV64 or vdso info for compat, there's no need to bloat riscv's\nmm_context_t, we can handle the difference when setup the additional\npage for vdso."
    }
  ],
  "lastModified": "2026-06-17T05:23:58.563",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}