CVE-2022-50206 (GCVE-0-2022-50206)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:03 – Updated: 2026-05-11 19:14
VLAI?
Title
arm64: fix oops in concurrently setting insn_emulation sysctls
Summary
In the Linux kernel, the following vulnerability has been resolved: arm64: fix oops in concurrently setting insn_emulation sysctls emulation_proc_handler() changes table->data for proc_dointvec_minmax and can generate the following Oops if called concurrently with itself: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 | Internal error: Oops: 96000006 [#1] SMP | Call trace: | update_insn_emulation_mode+0xc0/0x148 | emulation_proc_handler+0x64/0xb8 | proc_sys_call_handler+0x9c/0xf8 | proc_sys_write+0x18/0x20 | __vfs_write+0x20/0x48 | vfs_write+0xe4/0x1d0 | ksys_write+0x70/0xf8 | __arm64_sys_write+0x20/0x28 | el0_svc_common.constprop.0+0x7c/0x1c0 | el0_svc_handler+0x2c/0xa0 | el0_svc+0x8/0x200 To fix this issue, keep the table->data as &insn->current_mode and use container_of() to retrieve the insn pointer. Another mutex is used to protect against the current_mode update but not for retrieving insn_emulation as table->data is no longer changing.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 0be7320a635c2e434e8b67e0e9474a85ceb421c4 , < 9d5fec6ba2e4117d196a8259ab54615ffe562460 (git)
Affected: 0be7320a635c2e434e8b67e0e9474a85ceb421c4 , < b51881b1da57fe9877125dfdd0aac5172958fcfd (git)
Affected: 0be7320a635c2e434e8b67e0e9474a85ceb421c4 , < 04549063d5701976034d8c2bfda3d3a8cbf0409f (git)
Affected: 0be7320a635c2e434e8b67e0e9474a85ceb421c4 , < 353b4673d01c512303c45cf2346f630cda73b5c9 (git)
Affected: 0be7320a635c2e434e8b67e0e9474a85ceb421c4 , < cc69ef95988b9ef2fc730ec452a7441efb90ef5e (git)
Affected: 0be7320a635c2e434e8b67e0e9474a85ceb421c4 , < 6a2fd114678d7fc1b5a0f8865ae98f1c17787455 (git)
Affected: 0be7320a635c2e434e8b67e0e9474a85ceb421c4 , < 07022e07017ee5540f5559b0aeb916e8383c1e1a (git)
Affected: 0be7320a635c2e434e8b67e0e9474a85ceb421c4 , < af483947d472eccb79e42059276c4deed76f99a6 (git)
Create a notification for this product.
Linux Linux Affected: 3.7
Unaffected: 0 , < 3.7 (semver)
Unaffected: 4.14.291 , ≤ 4.14.* (semver)
Unaffected: 4.19.256 , ≤ 4.19.* (semver)
Unaffected: 5.4.211 , ≤ 5.4.* (semver)
Unaffected: 5.10.137 , ≤ 5.10.* (semver)
Unaffected: 5.15.61 , ≤ 5.15.* (semver)
Unaffected: 5.18.18 , ≤ 5.18.* (semver)
Unaffected: 5.19.2 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kernel/armv8_deprecated.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9d5fec6ba2e4117d196a8259ab54615ffe562460",
              "status": "affected",
              "version": "0be7320a635c2e434e8b67e0e9474a85ceb421c4",
              "versionType": "git"
            },
            {
              "lessThan": "b51881b1da57fe9877125dfdd0aac5172958fcfd",
              "status": "affected",
              "version": "0be7320a635c2e434e8b67e0e9474a85ceb421c4",
              "versionType": "git"
            },
            {
              "lessThan": "04549063d5701976034d8c2bfda3d3a8cbf0409f",
              "status": "affected",
              "version": "0be7320a635c2e434e8b67e0e9474a85ceb421c4",
              "versionType": "git"
            },
            {
              "lessThan": "353b4673d01c512303c45cf2346f630cda73b5c9",
              "status": "affected",
              "version": "0be7320a635c2e434e8b67e0e9474a85ceb421c4",
              "versionType": "git"
            },
            {
              "lessThan": "cc69ef95988b9ef2fc730ec452a7441efb90ef5e",
              "status": "affected",
              "version": "0be7320a635c2e434e8b67e0e9474a85ceb421c4",
              "versionType": "git"
            },
            {
              "lessThan": "6a2fd114678d7fc1b5a0f8865ae98f1c17787455",
              "status": "affected",
              "version": "0be7320a635c2e434e8b67e0e9474a85ceb421c4",
              "versionType": "git"
            },
            {
              "lessThan": "07022e07017ee5540f5559b0aeb916e8383c1e1a",
              "status": "affected",
              "version": "0be7320a635c2e434e8b67e0e9474a85ceb421c4",
              "versionType": "git"
            },
            {
              "lessThan": "af483947d472eccb79e42059276c4deed76f99a6",
              "status": "affected",
              "version": "0be7320a635c2e434e8b67e0e9474a85ceb421c4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/arm64/kernel/armv8_deprecated.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.7"
            },
            {
              "lessThan": "3.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.291",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.256",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.211",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.137",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.291",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.256",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.211",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.137",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.61",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.18",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.2",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "3.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\narm64: fix oops in concurrently setting insn_emulation sysctls\n\nemulation_proc_handler() changes table-\u003edata for proc_dointvec_minmax\nand can generate the following Oops if called concurrently with itself:\n\n | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010\n | Internal error: Oops: 96000006 [#1] SMP\n | Call trace:\n | update_insn_emulation_mode+0xc0/0x148\n | emulation_proc_handler+0x64/0xb8\n | proc_sys_call_handler+0x9c/0xf8\n | proc_sys_write+0x18/0x20\n | __vfs_write+0x20/0x48\n | vfs_write+0xe4/0x1d0\n | ksys_write+0x70/0xf8\n | __arm64_sys_write+0x20/0x28\n | el0_svc_common.constprop.0+0x7c/0x1c0\n | el0_svc_handler+0x2c/0xa0\n | el0_svc+0x8/0x200\n\nTo fix this issue, keep the table-\u003edata as \u0026insn-\u003ecurrent_mode and\nuse container_of() to retrieve the insn pointer. Another mutex is\nused to protect against the current_mode update but not for retrieving\ninsn_emulation as table-\u003edata is no longer changing."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:14:51.053Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9d5fec6ba2e4117d196a8259ab54615ffe562460"
        },
        {
          "url": "https://git.kernel.org/stable/c/b51881b1da57fe9877125dfdd0aac5172958fcfd"
        },
        {
          "url": "https://git.kernel.org/stable/c/04549063d5701976034d8c2bfda3d3a8cbf0409f"
        },
        {
          "url": "https://git.kernel.org/stable/c/353b4673d01c512303c45cf2346f630cda73b5c9"
        },
        {
          "url": "https://git.kernel.org/stable/c/cc69ef95988b9ef2fc730ec452a7441efb90ef5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a2fd114678d7fc1b5a0f8865ae98f1c17787455"
        },
        {
          "url": "https://git.kernel.org/stable/c/07022e07017ee5540f5559b0aeb916e8383c1e1a"
        },
        {
          "url": "https://git.kernel.org/stable/c/af483947d472eccb79e42059276c4deed76f99a6"
        }
      ],
      "title": "arm64: fix oops in concurrently setting insn_emulation sysctls",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50206",
    "datePublished": "2025-06-18T11:03:46.505Z",
    "dateReserved": "2025-06-18T10:57:27.428Z",
    "dateUpdated": "2026-05-11T19:14:51.053Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50206",
      "date": "2026-05-20",
      "epss": "0.00051",
      "percentile": "0.15753"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50206\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:51.390\",\"lastModified\":\"2025-11-19T12:45:43.787\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\narm64: fix oops in concurrently setting insn_emulation sysctls\\n\\nemulation_proc_handler() changes table-\u003edata for proc_dointvec_minmax\\nand can generate the following Oops if called concurrently with itself:\\n\\n | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010\\n | Internal error: Oops: 96000006 [#1] SMP\\n | Call trace:\\n | update_insn_emulation_mode+0xc0/0x148\\n | emulation_proc_handler+0x64/0xb8\\n | proc_sys_call_handler+0x9c/0xf8\\n | proc_sys_write+0x18/0x20\\n | __vfs_write+0x20/0x48\\n | vfs_write+0xe4/0x1d0\\n | ksys_write+0x70/0xf8\\n | __arm64_sys_write+0x20/0x28\\n | el0_svc_common.constprop.0+0x7c/0x1c0\\n | el0_svc_handler+0x2c/0xa0\\n | el0_svc+0x8/0x200\\n\\nTo fix this issue, keep the table-\u003edata as \u0026insn-\u003ecurrent_mode and\\nuse container_of() to retrieve the insn pointer. Another mutex is\\nused to protect against the current_mode update but not for retrieving\\ninsn_emulation as table-\u003edata is no longer changing.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: arm64: se corrige el error al configurar simult\u00e1neamente sysctls emulation_proc_handler() de insn_emulation y cambia table-\u0026gt;data para proc_dointvec_minmax, que puede generar el siguiente error si se llama simult\u00e1neamente consigo mismo: | No se puede controlar la desreferencia del puntero NULL del kernel en la direcci\u00f3n virtual 0000000000000010 | Error interno: Oops: 96000006 [#1] SMP | Rastreo de llamadas: | update_insn_emulation_mode+0xc0/0x148 | emulation_proc_handler+0x64/0xb8 | proc_sys_call_handler+0x9c/0xf8 | proc_sys_write+0x18/0x20 | __vfs_write+0x20/0x48 | Para solucionar este problema, mantenga la tabla-\u0026gt;data como \u0026amp;insn-\u0026gt;current_mode y use container_of() para recuperar el puntero insn. Se usa otro mutex para proteger contra la actualizaci\u00f3n de current_mode, pero no para recuperar la emulaci\u00f3n insn, ya que la tabla-\u0026gt;data ya no cambia.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.14.291\",\"matchCriteriaId\":\"88A26BF4-5BF4-43C0-A877-29781159FCB0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.15\",\"versionEndExcluding\":\"4.19.256\",\"matchCriteriaId\":\"6C47CDE3-B039-4AE5-B8E4-1DC820E473FF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.211\",\"matchCriteriaId\":\"B1C63D19-C08C-4308-A848-B2523C9275BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.137\",\"matchCriteriaId\":\"C2BF720F-C5EE-4DE2-9BDF-CE4CFBC767F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.61\",\"matchCriteriaId\":\"51861563-7F40-460F-82CD-2D3FBDAD6618\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.18.18\",\"matchCriteriaId\":\"5B42E453-8837-49D0-A5EF-03F818A6DC11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.19\",\"versionEndExcluding\":\"5.19.2\",\"matchCriteriaId\":\"A1A2A5A5-4598-4D7E-BA07-4660398D6C8F\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04549063d5701976034d8c2bfda3d3a8cbf0409f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/07022e07017ee5540f5559b0aeb916e8383c1e1a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/353b4673d01c512303c45cf2346f630cda73b5c9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6a2fd114678d7fc1b5a0f8865ae98f1c17787455\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9d5fec6ba2e4117d196a8259ab54615ffe562460\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/af483947d472eccb79e42059276c4deed76f99a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b51881b1da57fe9877125dfdd0aac5172958fcfd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cc69ef95988b9ef2fc730ec452a7441efb90ef5e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.