CVE-2022-50583
Last modified
CVE-2022-50583 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: md/raid0, raid10: Don't set discard sectors for request queue It should use disk_stack_limits to get a proper max_discard_sectors rather than setting a value by stack drivers. And there is a bug. If all member disks are rotational devices, raid0/raid10 set max_discard_sectors. EPSS estimates a 0.17% chance of exploitation in the next 30 days.
Description
In the Linux kernel, the following vulnerability has been resolved: md/raid0, raid10: Don't set discard sectors for request queue It should use disk_stack_limits to get a proper max_discard_sectors rather than setting a value by stack drivers. And there is a bug. If all member disks are rotational devices, raid0/raid10 set max_discard_sectors. So the member devices are not ssd/nvme, but raid0/raid10 export the wrong value. It reports warning messages in function __blkdev_issue_discard when mkfs.xfs like this: [ 4616.022599] ------------[ cut here ]------------ [ 4616.027779] WARNING: CPU: 4 PID: 99634 at block/blk-lib.c:50 __blkdev_issue_discard+0x16a/0x1a0 [ 4616.140663] RIP: 0010:__blkdev_issue_discard+0x16a/0x1a0 [ 4616.146601] Code: 24 4c 89 20 31 c0 e9 fe fe ff ff c1 e8 09 8d 48 ff 4c 89 f0 4c 09 e8 48 85 c1 0f 84 55 ff ff ff b8 ea ff ff ff e9 df fe ff ff <0f> 0b 48 8d 74 24 08 e8 ea d6 00 00 48 c7 c6 20 1e 89 ab 48 c7 c7 [ 4616.167567] RSP: 0018:ffffaab88cbffca8 EFLAGS: 00010246 [ 4616.173406] RAX: ffff9ba1f9e44678 RBX: 0000000000000000 RCX: ffff9ba1c9792080 [ 4616.181376] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9ba1c9792080 [ 4616.189345] RBP: 0000000000000cc0 R08: ffffaab88cbffd10 R09: 0000000000000000 [ 4616.197317] R10: 0000000000000012 R11: 0000000000000000 R12: 0000000000000000 [ 4616.205288] R13: 0000000000400000 R14: 0000000000000cc0 R15: ffff9ba1c9792080 [ 4616.213259] FS: 00007f9a5534e980(0000) GS:ffff9ba1b7c80000(0000) knlGS:0000000000000000 [ 4616.222298] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4616.228719] CR2: 000055a390a4c518 CR3: 0000000123e40006 CR4: 00000000001706e0 [ 4616.236689] Call Trace: [ 4616.239428] blkdev_issue_discard+0x52/0xb0 [ 4616.244108] blkdev_common_ioctl+0x43c/0xa00 [ 4616.248883] blkdev_ioctl+0x116/0x280 [ 4616.252977] __x64_sys_ioctl+0x8a/0xc0 [ 4616.257163] do_syscall_64+0x5c/0x90 [ 4616.261164] ? handle_mm_fault+0xc5/0x2a0 [ 4616.265652] ? do_user_addr_fault+0x1d8/0x690 [ 4616.270527] ? do_syscall_64+0x69/0x90 [ 4616.274717] ? exc_page_fault+0x62/0x150 [ 4616.279097] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 4616.284748] RIP: 0033:0x7f9a55398c6b
Metrics
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= 70200574cc229f6ba038259e8142af2aa09e6976, < e80bef070699d2e791badefccb1ddabd6998d468; >= 70200574cc229f6ba038259e8142af2aa09e6976, < 27e5d61a8e6919b5c0c6f473703ffea2acba862a; >= 70200574cc229f6ba038259e8142af2aa09e6976, < 8e1a2279ca2b0485cc379a153d02a9793f74a48f |
| Linux | Linux | 5.19 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2022-50583?
How severe is CVE-2022-50583?
How do I fix CVE-2022-50583?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-50577In the Linux kernel, the following vulnerability has been re…
- CVE-2022-50578In the Linux kernel, the following vulnerability has been re…
- CVE-2022-50579In the Linux kernel, the following vulnerability has been re…
- CVE-2022-50580In the Linux kernel, the following vulnerability has been re…
- CVE-2022-50581In the Linux kernel, the following vulnerability has been re…7.8
- CVE-2022-50582In the Linux kernel, the following vulnerability has been re…
- CVE-2022-50584The Core Config Manager (CCM) in Nagios XI versions prior to…5.4
- CVE-2022-50585The Core Config Manager (CCM) in Nagios XI versions prior to…5.4
- CVE-2022-50586Nagios XI versions prior to 5.8.9 are vulnerable to cross-si…5.4
- CVE-2022-50587Nagios XI versions prior to 5.8.9 are vulnerable to cross-si…5.4
- CVE-2022-50588Nagios XI versions prior to 5.8.9 are vulnerable to cross-si…5.4
- CVE-2022-50589SuiteCRM versions prior to 7.12.6 contain a SQL injection vu…9.8
Are you affected by CVE-2022-50583?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST
