CVE-2022-50167
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: bpf: fix potential 32-bit overflow when accessing ARRAY map element If BPF array map is bigger than 4GB, element pointer calculation can overflow because both index and elem_size are u32. Fix this everywhere by forcing 64-bit multiplication. Extract this formula into separate small helper and use it consistently in various places. Speculative-preventing formula utilizing index_mask trick is left as is, but explicit u64 casts are added in both places.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Modified
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-06-18 11:15:47.010000
Last modified
2026-10-30 13:17:14.400000
View original CVE JSON
{
"id": "CVE-2022-50167",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2025-06-18T11:15:47.010",
"lastModified": "2026-10-30T13:17:14.400",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix potential 32-bit overflow when accessing ARRAY map element\n\nIf BPF array map is bigger than 4GB, element pointer calculation can\noverflow because both index and elem_size are u32. Fix this everywhere\nby forcing 64-bit multiplication. Extract this formula into separate\nsmall helper and use it consistently in various places.\n\nSpeculative-preventing formula utilizing index_mask trick is left as is,\nbut explicit u64 casts are added in both places."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: se corrige un posible desbordamiento de 32 bits al acceder al elemento del mapa de matriz. Si el mapa de matriz BPF supera los 4 GB, el cálculo del puntero del elemento puede desbordarse, ya que tanto el índice como el tamaño de elem son u32. Se corrige este problema en todas partes forzando la multiplicación de 64 bits. Se extrae esta fórmula en un pequeño ayudante independiente y se usa de forma consistente en varios lugares. La fórmula que evita la especulación mediante el truco de index_mask se mantiene sin cambios, pero se añaden conversiones u64 explícitas en ambos lugares."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"kernel/bpf/arraymap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
"lessThan": "2157ac13db8d5763835f1663bdabda6de744cba8",
"versionType": "git",
"status": "affected"
},
{
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
"lessThan": "f665c56e6836933335e5a4513fc9b0bf47cdf81f",
"versionType": "git",
"status": "affected"
},
{
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
"lessThan": "063e092534d4c6785228e5b1eb6e9329f66ccbe4",
"versionType": "git",
"status": "affected"
},
{
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
"lessThan": "3c7256b880b3a5aa1895fd169a34aa4224a11862",
"versionType": "git",
"status": "affected"
},
{
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
"lessThan": "87ac0d600943994444e24382a87aa19acc4cd3d4",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"kernel/bpf/arraymap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.3",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.3",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.273",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.224",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.18.18",
"lessThanOrEqual": "5.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.19.2",
"lessThanOrEqual": "5.19.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.0",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-10-15T21:30:17.190513Z",
"id": "CVE-2022-50167",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-190"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.3",
"versionEndExcluding": "5.18.18",
"matchCriteriaId": "B02C474E-3473-42B0-8C3A-FE88F36ABE5A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.19",
"versionEndExcluding": "5.19.2",
"matchCriteriaId": "A1A2A5A5-4598-4D7E-BA07-4660398D6C8F"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/063e092534d4c6785228e5b1eb6e9329f66ccbe4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/2157ac13db8d5763835f1663bdabda6de744cba8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3c7256b880b3a5aa1895fd169a34aa4224a11862",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/87ac0d600943994444e24382a87aa19acc4cd3d4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/f665c56e6836933335e5a4513fc9b0bf47cdf81f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}