« Volver al listado

CVE-2022-50756

Estado: AplazadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: fix mempool alloc size

Convert the max size to bytes to match the units of the divisor that calculates the worst-case number of PRP entries.

The result is used to determine how many PRP Lists are required. The code was previously rounding this to 1 list, but we can require 2 in the worst case. In that scenario, the driver would corrupt memory beyond the size provided by the mempool.

While unlikely to occur (you'd need a 4MB in exactly 127 phys segments on a queue that doesn't support SGLs), this memory corruption has been observed by kfence.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L/PR:L sin UI indica escalada local. Memory corruption en mempool del kernel (más allá del buffer asignado) permite manipulación de datos de kernel y potencial DoS.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramRestrict File and Directory PermissionsRemote Data StorageFilter Network TrafficExecution PreventionEncrypt Sensitive Information

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-50756",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "943e942e6266f22babee5efeb00f8f672fbff5bd",
              "lessThan": "dfb6d54893d544151e7f480bc44cfe7823f5ad23",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "943e942e6266f22babee5efeb00f8f672fbff5bd",
              "lessThan": "9141144b37f30e3e7fa024bcfa0a13011e546ba9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "943e942e6266f22babee5efeb00f8f672fbff5bd",
              "lessThan": "e1777b4286e526c58b4ee699344b0ad85aaf83a0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "943e942e6266f22babee5efeb00f8f672fbff5bd",
              "lessThan": "b1814724e0d7162bdf4799f2d565381bc2251c63",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "943e942e6266f22babee5efeb00f8f672fbff5bd",
              "lessThan": "c89a529e823d51dd23c7ec0c047c7a454a428541",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/nvme/host/pci.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.18",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.87",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.0.17",
              "versionType": "semver",
              "lessThanOrEqual": "6.0.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.3",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/nvme/host/pci.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-12-24T13:16:02.353",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/9141144b37f30e3e7fa024bcfa0a13011e546ba9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b1814724e0d7162bdf4799f2d565381bc2251c63",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c89a529e823d51dd23c7ec0c047c7a454a428541",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/dfb6d54893d544151e7f480bc44cfe7823f5ad23",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e1777b4286e526c58b4ee699344b0ad85aaf83a0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Deferred",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: fix mempool alloc size\n\nConvert the max size to bytes to match the units of the divisor that\ncalculates the worst-case number of PRP entries.\n\nThe result is used to determine how many PRP Lists are required. The\ncode was previously rounding this to 1 list, but we can require 2 in the\nworst case. In that scenario, the driver would corrupt memory beyond the\nsize provided by the mempool.\n\nWhile unlikely to occur (you'd need a 4MB in exactly 127 phys segments\non a queue that doesn't support SGLs), this memory corruption has been\nobserved by kfence."
    }
  ],
  "lastModified": "2026-08-04T10:18:23.647",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}