CVE-2022-50656
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Clear nfc_target before being used Fix a slab-out-of-bounds read that occurs in nla_put() called from nfc_genl_send_target() when target->sensb_res_len, which is duplicated from an nfc_target in pn533, is too large as the nfc_target is not properly initialized and retains garbage values. Clear nfc_targets with memset() before they are used. Found by a modified version of syzkaller. BUG: KASAN: slab-out-of-bounds in nla_put Call Trace: memcpy nla_put nfc_genl_dump_targets genl_lock_dumpit netlink_dump __netlink_dump_start genl_family_rcv_msg_dumpit genl_rcv_msg netlink_rcv_skb genl_rcv netlink_unicast netlink_sendmsg sock_sendmsg ____sys_sendmsg ___sys_sendmsg __sys_sendmsg do_syscall_64
Affected versions
Linux kernel versions
3.3
and later are affected. Fixed in
4.9.337,
4.14.303,
4.19.270,
5.4.229,
5.10.163,
5.15.86,
6.0.16,
6.1.2,
6.2
and their respective stable series.
References
The following references provide additional information about CVE-2022-50656 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/61a7e15d55fae329a245535c3bac494e401005b8
-
PatchKernel patch commithttps://git.kernel.org/stable/c/755019e37815a66bb0a23893debbd3dd640ccbd3
-
PatchKernel patch commithttps://git.kernel.org/stable/c/8bddef54cbe9ede5ac7478f1e1e968fcfe7e6f03
Frequently asked questions
-
What is CVE-2022-50656?
CVE-2022-50656 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 3.3 onward and has been patched in 4.9.337, 4.14.303, 4.19.270 and others. CVE-2022-50656 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2022-50656?
Yes — CVE-2022-50656 has been patched. Fixed versions include 4.9.337, 4.14.303, 4.19.270 and others. If you are running Linux kernel 3.3 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2022-50656 actively exploited?
No — CVE-2022-50656 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.