CVE-2022-50400
Last modified
CVE-2022-50400 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: staging: greybus: audio_helper: remove unused and wrong debugfs usage In the greybus audio_helper code, the debugfs file for the dapm has the potential to be removed and memory will be leaked. There is also the very real potential for this code to remove ALL debugfs entries from the system, and it seems like this is what will really happen if this code ever runs. EPSS estimates a 0.14% chance of exploitation in the next 30 days.
Description
In the Linux kernel, the following vulnerability has been resolved: staging: greybus: audio_helper: remove unused and wrong debugfs usage In the greybus audio_helper code, the debugfs file for the dapm has the potential to be removed and memory will be leaked. There is also the very real potential for this code to remove ALL debugfs entries from the system, and it seems like this is what will really happen if this code ever runs. This all is very wrong as the greybus audio driver did not create this debugfs file, the sound core did and controls the lifespan of it. So remove all of the debugfs logic from the audio_helper code as there's no way it could be correct. If this really is needed, it can come back with a fixup for the incorrect usage of the debugfs_lookup() call which is what caused this to be noticed at all.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | < 5.10.150 |
| Linux | Linux Kernel | >= 5.11, < 5.15.75 |
| Linux | Linux Kernel | >= 5.16, < 5.19.17 |
| Linux | Linux Kernel | >= 6.0, < 6.0.3 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-50400?
How severe is CVE-2022-50400?
How do I fix CVE-2022-50400?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-50394In the Linux kernel, the following vulnerability has been re…7.1
- CVE-2022-50395In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-50396In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-50397Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2022-50398In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-50399In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-50401In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2022-50402In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-50403Rejected reason: This CVE ID has been rejected or withdrawn …
- CVE-2022-50404In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-50405In the Linux kernel, the following vulnerability has been re…5.5
- CVE-2022-50406In the Linux kernel, the following vulnerability has been re…7.8
Are you affected by CVE-2022-50400?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST