CVE-2022-50094 (GCVE-0-2022-50094)
Vulnerability from cvelistv5
Published
2025-06-18 11:02
Modified
2025-06-18 11:02
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: spmi: trace: fix stack-out-of-bound access in SPMI tracing functions trace_spmi_write_begin() and trace_spmi_read_end() both call memcpy() with a length of "len + 1". This leads to one extra byte being read beyond the end of the specified buffer. Fix this out-of-bound memory access by using a length of "len" instead. Here is a KASAN log showing the issue: BUG: KASAN: stack-out-of-bounds in trace_event_raw_event_spmi_read_end+0x1d0/0x234 Read of size 2 at addr ffffffc0265b7540 by task thermal@2.0-ser/1314 ... Call trace: dump_backtrace+0x0/0x3e8 show_stack+0x2c/0x3c dump_stack_lvl+0xdc/0x11c print_address_description+0x74/0x384 kasan_report+0x188/0x268 kasan_check_range+0x270/0x2b0 memcpy+0x90/0xe8 trace_event_raw_event_spmi_read_end+0x1d0/0x234 spmi_read_cmd+0x294/0x3ac spmi_ext_register_readl+0x84/0x9c regmap_spmi_ext_read+0x144/0x1b0 [regmap_spmi] _regmap_raw_read+0x40c/0x754 regmap_raw_read+0x3a0/0x514 regmap_bulk_read+0x418/0x494 adc5_gen3_poll_wait_hs+0xe8/0x1e0 [qcom_spmi_adc5_gen3] ... __arm64_sys_read+0x4c/0x60 invoke_syscall+0x80/0x218 el0_svc_common+0xec/0x1c8 ... addr ffffffc0265b7540 is located in stack of task thermal@2.0-ser/1314 at offset 32 in frame: adc5_gen3_poll_wait_hs+0x0/0x1e0 [qcom_spmi_adc5_gen3] this frame has 1 object: [32, 33) 'status' Memory state around the buggy address: ffffffc0265b7400: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 ffffffc0265b7480: 04 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffc0265b7500: 00 00 00 00 f1 f1 f1 f1 01 f3 f3 f3 00 00 00 00 ^ ffffffc0265b7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffc0265b7600: f1 f1 f1 f1 01 f2 07 f2 f2 f2 01 f3 00 00 00 00 ==================================================================
References
Impacted products
Vendor Product Version
Linux Linux Version: a9fce374815d8ab94a3e6259802a944e2cc21408
Version: a9fce374815d8ab94a3e6259802a944e2cc21408
Version: a9fce374815d8ab94a3e6259802a944e2cc21408
Version: a9fce374815d8ab94a3e6259802a944e2cc21408
Version: a9fce374815d8ab94a3e6259802a944e2cc21408
Version: a9fce374815d8ab94a3e6259802a944e2cc21408
Version: a9fce374815d8ab94a3e6259802a944e2cc21408
Version: a9fce374815d8ab94a3e6259802a944e2cc21408
Version: a9fce374815d8ab94a3e6259802a944e2cc21408
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/trace/events/spmi.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "80f7c93e573ea9f524924bb529c2af8cb28b1c43",
              "status": "affected",
              "version": "a9fce374815d8ab94a3e6259802a944e2cc21408",
              "versionType": "git"
            },
            {
              "lessThan": "dc6033a7761254e5a5ba7df36b64db787a53313c",
              "status": "affected",
              "version": "a9fce374815d8ab94a3e6259802a944e2cc21408",
              "versionType": "git"
            },
            {
              "lessThan": "ac730c72bddc889f5610d51d8a7abf425e08da1a",
              "status": "affected",
              "version": "a9fce374815d8ab94a3e6259802a944e2cc21408",
              "versionType": "git"
            },
            {
              "lessThan": "37690cb8662cec672cacda19e6e4fd2ca7b13f0b",
              "status": "affected",
              "version": "a9fce374815d8ab94a3e6259802a944e2cc21408",
              "versionType": "git"
            },
            {
              "lessThan": "dd02510fb43168310abfd0b9ccf49993a722fb91",
              "status": "affected",
              "version": "a9fce374815d8ab94a3e6259802a944e2cc21408",
              "versionType": "git"
            },
            {
              "lessThan": "1e0ca3d809c36ad3d1f542917718fc22ec6316e7",
              "status": "affected",
              "version": "a9fce374815d8ab94a3e6259802a944e2cc21408",
              "versionType": "git"
            },
            {
              "lessThan": "bcc1b6b1ed3f42ed25858c1f1eb24a2f741db93f",
              "status": "affected",
              "version": "a9fce374815d8ab94a3e6259802a944e2cc21408",
              "versionType": "git"
            },
            {
              "lessThan": "504090815c1ad3fd3fa34618b54d706727f8911c",
              "status": "affected",
              "version": "a9fce374815d8ab94a3e6259802a944e2cc21408",
              "versionType": "git"
            },
            {
              "lessThan": "2af28b241eea816e6f7668d1954f15894b45d7e3",
              "status": "affected",
              "version": "a9fce374815d8ab94a3e6259802a944e2cc21408",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/trace/events/spmi.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.3"
            },
            {
              "lessThan": "4.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.326",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.256",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.137",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.326",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.291",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.256",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.211",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.137",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.61",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.18",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.2",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "4.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspmi: trace: fix stack-out-of-bound access in SPMI tracing functions\n\ntrace_spmi_write_begin() and trace_spmi_read_end() both call\nmemcpy() with a length of \"len + 1\".  This leads to one extra\nbyte being read beyond the end of the specified buffer.  Fix\nthis out-of-bound memory access by using a length of \"len\"\ninstead.\n\nHere is a KASAN log showing the issue:\n\nBUG: KASAN: stack-out-of-bounds in trace_event_raw_event_spmi_read_end+0x1d0/0x234\nRead of size 2 at addr ffffffc0265b7540 by task thermal@2.0-ser/1314\n...\nCall trace:\n dump_backtrace+0x0/0x3e8\n show_stack+0x2c/0x3c\n dump_stack_lvl+0xdc/0x11c\n print_address_description+0x74/0x384\n kasan_report+0x188/0x268\n kasan_check_range+0x270/0x2b0\n memcpy+0x90/0xe8\n trace_event_raw_event_spmi_read_end+0x1d0/0x234\n spmi_read_cmd+0x294/0x3ac\n spmi_ext_register_readl+0x84/0x9c\n regmap_spmi_ext_read+0x144/0x1b0 [regmap_spmi]\n _regmap_raw_read+0x40c/0x754\n regmap_raw_read+0x3a0/0x514\n regmap_bulk_read+0x418/0x494\n adc5_gen3_poll_wait_hs+0xe8/0x1e0 [qcom_spmi_adc5_gen3]\n ...\n __arm64_sys_read+0x4c/0x60\n invoke_syscall+0x80/0x218\n el0_svc_common+0xec/0x1c8\n ...\n\naddr ffffffc0265b7540 is located in stack of task thermal@2.0-ser/1314 at offset 32 in frame:\n adc5_gen3_poll_wait_hs+0x0/0x1e0 [qcom_spmi_adc5_gen3]\n\nthis frame has 1 object:\n [32, 33) \u0027status\u0027\n\nMemory state around the buggy address:\n ffffffc0265b7400: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1\n ffffffc0265b7480: 04 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00\n\u003effffffc0265b7500: 00 00 00 00 f1 f1 f1 f1 01 f3 f3 f3 00 00 00 00\n                                           ^\n ffffffc0265b7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n ffffffc0265b7600: f1 f1 f1 f1 01 f2 07 f2 f2 f2 01 f3 00 00 00 00\n=================================================================="
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-18T11:02:32.591Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/80f7c93e573ea9f524924bb529c2af8cb28b1c43"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc6033a7761254e5a5ba7df36b64db787a53313c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ac730c72bddc889f5610d51d8a7abf425e08da1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/37690cb8662cec672cacda19e6e4fd2ca7b13f0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd02510fb43168310abfd0b9ccf49993a722fb91"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e0ca3d809c36ad3d1f542917718fc22ec6316e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/bcc1b6b1ed3f42ed25858c1f1eb24a2f741db93f"
        },
        {
          "url": "https://git.kernel.org/stable/c/504090815c1ad3fd3fa34618b54d706727f8911c"
        },
        {
          "url": "https://git.kernel.org/stable/c/2af28b241eea816e6f7668d1954f15894b45d7e3"
        }
      ],
      "title": "spmi: trace: fix stack-out-of-bound access in SPMI tracing functions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50094",
    "datePublished": "2025-06-18T11:02:32.591Z",
    "dateReserved": "2025-06-18T10:57:27.411Z",
    "dateUpdated": "2025-06-18T11:02:32.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50094\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:38.620\",\"lastModified\":\"2025-06-18T13:47:40.833\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nspmi: trace: fix stack-out-of-bound access in SPMI tracing functions\\n\\ntrace_spmi_write_begin() and trace_spmi_read_end() both call\\nmemcpy() with a length of \\\"len + 1\\\".  This leads to one extra\\nbyte being read beyond the end of the specified buffer.  Fix\\nthis out-of-bound memory access by using a length of \\\"len\\\"\\ninstead.\\n\\nHere is a KASAN log showing the issue:\\n\\nBUG: KASAN: stack-out-of-bounds in trace_event_raw_event_spmi_read_end+0x1d0/0x234\\nRead of size 2 at addr ffffffc0265b7540 by task thermal@2.0-ser/1314\\n...\\nCall trace:\\n dump_backtrace+0x0/0x3e8\\n show_stack+0x2c/0x3c\\n dump_stack_lvl+0xdc/0x11c\\n print_address_description+0x74/0x384\\n kasan_report+0x188/0x268\\n kasan_check_range+0x270/0x2b0\\n memcpy+0x90/0xe8\\n trace_event_raw_event_spmi_read_end+0x1d0/0x234\\n spmi_read_cmd+0x294/0x3ac\\n spmi_ext_register_readl+0x84/0x9c\\n regmap_spmi_ext_read+0x144/0x1b0 [regmap_spmi]\\n _regmap_raw_read+0x40c/0x754\\n regmap_raw_read+0x3a0/0x514\\n regmap_bulk_read+0x418/0x494\\n adc5_gen3_poll_wait_hs+0xe8/0x1e0 [qcom_spmi_adc5_gen3]\\n ...\\n __arm64_sys_read+0x4c/0x60\\n invoke_syscall+0x80/0x218\\n el0_svc_common+0xec/0x1c8\\n ...\\n\\naddr ffffffc0265b7540 is located in stack of task thermal@2.0-ser/1314 at offset 32 in frame:\\n adc5_gen3_poll_wait_hs+0x0/0x1e0 [qcom_spmi_adc5_gen3]\\n\\nthis frame has 1 object:\\n [32, 33) \u0027status\u0027\\n\\nMemory state around the buggy address:\\n ffffffc0265b7400: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1\\n ffffffc0265b7480: 04 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00\\n\u003effffffc0265b7500: 00 00 00 00 f1 f1 f1 f1 01 f3 f3 f3 00 00 00 00\\n                                           ^\\n ffffffc0265b7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\\n ffffffc0265b7600: f1 f1 f1 f1 01 f2 07 f2 f2 f2 01 f3 00 00 00 00\\n==================================================================\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: spmi: trace: se corrige el acceso fuera de los l\u00edmites de la pila en las funciones de seguimiento de SPMI. Las funciones trace_spmi_write_begin() y trace_spmi_read_end() llaman a memcpy() con una longitud de \\\"len + 1\\\". Esto provoca la lectura de un byte adicional m\u00e1s all\u00e1 del final del b\u00fafer especificado. Corrija este acceso fuera de los l\u00edmites de la pila utilizando una longitud de \\\"len\\\". Aqu\u00ed hay un registro de KASAN que muestra el problema: ERROR: KASAN: pila fuera de los l\u00edmites en trace_event_raw_event_spmi_read_end+0x1d0/0x234 Lectura de tama\u00f1o 2 en la direcci\u00f3n ffffffc0265b7540 por la tarea thermal@2.0-ser/1314 ... Seguimiento de llamadas: dump_backtrace+0x0/0x3e8 show_stack+0x2c/0x3c dump_stack_lvl+0xdc/0x11c print_address_description+0x74/0x384 kasan_report+0x188/0x268 kasan_check_range+0x270/0x2b0 memcpy+0x90/0xe8 trace_event_raw_event_spmi_read_end+0x1d0/0x234 spmi_read_cmd+0x294/0x3ac spmi_ext_register_readl+0x84/0x9c regmap_spmi_ext_read+0x144/0x1b0 [regmap_spmi] _regmap_raw_read+0x40c/0x754 regmap_raw_read+0x3a0/0x514 regmap_bulk_read+0x418/0x494 adc5_gen3_poll_wait_hs+0xe8/0x1e0 [qcom_spmi_adc5_gen3] ... __arm64_sys_read+0x4c/0x60 invoke_syscall+0x80/0x218 el0_svc_common+0xec/0x1c8 ... la direcci\u00f3n ffffffc0265b7540 se encuentra en la pila de tareas thermal@2.0-ser/1314 en el desplazamiento 32 en el marco: adc5_gen3_poll_wait_hs+0x0/0x1e0 [qcom_spmi_adc5_gen3] este marco tiene 1 objeto: [32, 33) \u0027status\u0027 Estado de la memoria alrededor de la direcci\u00f3n con errores: ffffffc0265b7400: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 fffffc0265b7480: 04 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 \u0026gt;fffffc0265b7500: 00 00 00 00 f1 f1 f1 f1 01 f3 f3 f3 00 00 00 00 ^ ffffffc0265b7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffc0265b7600: f1 f1 f1 f1 01 f2 07 f2 f2 f2 01 f3 00 00 00 00 ====================================================================\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1e0ca3d809c36ad3d1f542917718fc22ec6316e7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2af28b241eea816e6f7668d1954f15894b45d7e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/37690cb8662cec672cacda19e6e4fd2ca7b13f0b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/504090815c1ad3fd3fa34618b54d706727f8911c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/80f7c93e573ea9f524924bb529c2af8cb28b1c43\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ac730c72bddc889f5610d51d8a7abf425e08da1a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bcc1b6b1ed3f42ed25858c1f1eb24a2f741db93f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dc6033a7761254e5a5ba7df36b64db787a53313c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dd02510fb43168310abfd0b9ccf49993a722fb91\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.