Vulnerability-Lookup

BDU:2026-08845 (CVE-2022-50257)

Vulnerability from fstec – Published: 2026-06-26 – Updated: 2026-06-26 – View on bdu.fstec.ru Fixed

Title

Уязвимость функций gntdev_map_grant_pages() и __unmap_grant_pages_done() модуля drivers/xen/gntdev.c драйвера устройств кадрового буфера ядра операционной системы Linux, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость функций gntdev_map_grant_pages() и __unmap_grant_pages_done() модуля drivers/xen/gntdev.c драйвера устройств кадрового буфера ядра операционной системы Linux связана с утечкой памяти. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании

Severity

4.6 (Medium) CVSS 2.0


                      
                        AV:L/AC:L/Au:S/C:N/I:N/A:C

5.5 (Medium) CVSS 3.1


                      
                        CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Resource exhaustion

Incidents

Being clarified

Remediation

Software update

CWE

CWE-401 - Неправильное освобождение памяти перед удалением последней ссылки («утечка памяти»)

Aliases

CVE-2022-50257

References

20 references

URL
https://www.cve.org/CVERecord?id=CVE-2022-50257
https://git.kernel.org/stable/c/b043f2cab100bed3e0a999dcf38cc05b1e4a7e41
https://git.kernel.org/stable/c/49bb053b1ec367b6883030eb2cca696e91435679
https://git.kernel.org/stable/c/cb1ccfe7655380f77a58b340072f5f40bc285902
https://git.kernel.org/stable/c/3d056d81b93a787613eda44aeb21fc14c3392b34
https://git.kernel.org/stable/c/49db6cb81400ba863e1a85e55fcdf1031807c23f
https://git.kernel.org/stable/c/1cb73704cb4778299609634a790a80daba582f7d
https://git.kernel.org/stable/c/0bccddd9b8f03ad57bb738f0d3da8845d4e1e579
https://git.kernel.org/stable/c/273f6a4f71be12e2ec80a4919837d6e4fa933a04
https://git.kernel.org/linus/0991028cd49567d7016d1b224fe0117c35059f86
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.332
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.298
https://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.264
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.223
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.153
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.75
https://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.17
https://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.3
https://security-tracker.debian.org/tracker/CVE-2022-50257
https://ubuntu.com/security/CVE-2022-50257

Impacted products

3 products from 2 vendors

Vendors

Canonical Ltd., Сообщество свободного программного обеспечения

Products

Ubuntu, Debian GNU/Linux, Linux

Versions

18.04 LTS (Ubuntu), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 22.04 LTS (Ubuntu), от 6.0 до 6.0.2 включительно (Linux), от 4.9.322 до 4.9.331 включительно (Linux), от 4.14.287 до 4.14.297 включительно (Linux), от 4.19.251 до 4.19.263 включительно (Linux), от 5.4.204 до 5.4.222 включительно (Linux), от 5.10.129 до 5.10.152 включительно (Linux), от 5.15.51 до 5.15.74 включительно (Linux), от 5.18.8 до 5.19.16 включительно (Linux)

Product types

Operating system

Platforms

Canonical Ltd. Ubuntu 18.04 LTS, Canonical Ltd. Ubuntu 20.04 LTS, Сообщество свободного программного обеспечения Debian GNU/Linux 11, Canonical Ltd. Ubuntu 22.04 LTS, Сообщество свободного программного обеспечения Linux от 6.0 до 6.0.2 включительно, Сообщество свободного программного обеспечения Linux от 4.9.322 до 4.9.331 включительно, Сообщество свободного программного обеспечения Linux от 4.14.287 до 4.14.297 включительно, Сообщество свободного программного обеспечения Linux от 4.19.251 до 4.19.263 включительно, Сообщество свободного программного обеспечения Linux от 5.4.204 до 5.4.222 включительно, Сообщество свободного программного обеспечения Linux от 5.10.129 до 5.10.152 включительно, Сообщество свободного программного обеспечения Linux от 5.15.51 до 5.15.74 включительно, Сообщество свободного программного обеспечения Linux от 5.18.8 до 5.19.16 включительно

Mitigations

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:L/Au:S/C:N/I:N/A:C",
  "CVSS 3.0": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Canonical Ltd., \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "18.04 LTS (Ubuntu), 20.04 LTS (Ubuntu), 11 (Debian GNU/Linux), 22.04 LTS (Ubuntu), \u043e\u0442 6.0 \u0434\u043e 6.0.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 4.9.322 \u0434\u043e 4.9.331 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 4.14.287 \u0434\u043e 4.14.297 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 4.19.251 \u0434\u043e 4.19.263 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 5.4.204 \u0434\u043e 5.4.222 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 5.10.129 \u0434\u043e 5.10.152 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 5.15.51 \u0434\u043e 5.15.74 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux), \u043e\u0442 5.18.8 \u0434\u043e 5.19.16 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e (Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Linux:\nhttps://git.kernel.org/stable/c/b043f2cab100bed3e0a999dcf38cc05b1e4a7e41\nhttps://git.kernel.org/stable/c/49bb053b1ec367b6883030eb2cca696e91435679\nhttps://git.kernel.org/stable/c/cb1ccfe7655380f77a58b340072f5f40bc285902\nhttps://git.kernel.org/stable/c/3d056d81b93a787613eda44aeb21fc14c3392b34\nhttps://git.kernel.org/stable/c/49db6cb81400ba863e1a85e55fcdf1031807c23f\nhttps://git.kernel.org/stable/c/1cb73704cb4778299609634a790a80daba582f7d\nhttps://git.kernel.org/stable/c/0bccddd9b8f03ad57bb738f0d3da8845d4e1e579\nhttps://git.kernel.org/stable/c/273f6a4f71be12e2ec80a4919837d6e4fa933a04\nhttps://git.kernel.org/linus/0991028cd49567d7016d1b224fe0117c35059f86\n\n\u0414\u043b\u044f Debian GNU/Linux:\nhttps://security-tracker.debian.org/tracker/CVE-2022-50257\n\n\u0414\u043b\u044f \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 Ubuntu:\nhttps://ubuntu.com/security/CVE-2022-50257",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "02.10.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "26.06.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "26.06.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-08845",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2022-50257",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Ubuntu, Debian GNU/Linux, Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "Canonical Ltd. Ubuntu 18.04 LTS , Canonical Ltd. Ubuntu 20.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Debian GNU/Linux 11 , Canonical Ltd. Ubuntu 22.04 LTS , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 6.0 \u0434\u043e 6.0.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 4.9.322 \u0434\u043e 4.9.331 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 4.14.287 \u0434\u043e 4.14.297 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 4.19.251 \u0434\u043e 4.19.263 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.4.204 \u0434\u043e 5.4.222 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.10.129 \u0434\u043e 5.10.152 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.15.51 \u0434\u043e 5.15.74 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e , \u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f Linux \u043e\u0442 5.18.8 \u0434\u043e 5.19.16 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e ",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0439 gntdev_map_grant_pages() \u0438 __unmap_grant_pages_done() \u043c\u043e\u0434\u0443\u043b\u044f drivers/xen/gntdev.c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043a\u0430\u0434\u0440\u043e\u0432\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0435\u0440\u0435\u0434 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u0435\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0441\u0441\u044b\u043b\u043a\u0438 (\u00ab\u0443\u0442\u0435\u0447\u043a\u0430 \u043f\u0430\u043c\u044f\u0442\u0438\u00bb) (CWE-401)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0439 gntdev_map_grant_pages() \u0438 __unmap_grant_pages_done() \u043c\u043e\u0434\u0443\u043b\u044f drivers/xen/gntdev.c \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043a\u0430\u0434\u0440\u043e\u0432\u043e\u0433\u043e \u0431\u0443\u0444\u0435\u0440\u0430 \u044f\u0434\u0440\u0430 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Linux \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0443\u0442\u0435\u0447\u043a\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0418\u0441\u0447\u0435\u0440\u043f\u0430\u043d\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://www.cve.org/CVERecord?id=CVE-2022-50257\nhttps://git.kernel.org/stable/c/b043f2cab100bed3e0a999dcf38cc05b1e4a7e41\nhttps://git.kernel.org/stable/c/49bb053b1ec367b6883030eb2cca696e91435679\nhttps://git.kernel.org/stable/c/cb1ccfe7655380f77a58b340072f5f40bc285902\nhttps://git.kernel.org/stable/c/3d056d81b93a787613eda44aeb21fc14c3392b34\nhttps://git.kernel.org/stable/c/49db6cb81400ba863e1a85e55fcdf1031807c23f\nhttps://git.kernel.org/stable/c/1cb73704cb4778299609634a790a80daba582f7d\nhttps://git.kernel.org/stable/c/0bccddd9b8f03ad57bb738f0d3da8845d4e1e579\nhttps://git.kernel.org/stable/c/273f6a4f71be12e2ec80a4919837d6e4fa933a04\nhttps://git.kernel.org/linus/0991028cd49567d7016d1b224fe0117c35059f86\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.332\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.298\nhttps://kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.264\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.223\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.153\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.75\nhttps://kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.17\nhttps://kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.3\nhttps://security-tracker.debian.org/tracker/CVE-2022-50257\nhttps://ubuntu.com/security/CVE-2022-50257",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-401",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,6)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5,5)"
}

CVE-2022-50257 (GCVE-0-2022-50257)

Vulnerability from cvelistv5 – Published: 2025-09-15 14:02 – Updated: 2026-05-23 15:23

Title

xen/gntdev: Prevent leaking grants

Summary

In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: Prevent leaking grants Prior to this commit, if a grant mapping operation failed partially, some of the entries in the map_ops array would be invalid, whereas all of the entries in the kmap_ops array would be valid. This in turn would cause the following logic in gntdev_map_grant_pages to become invalid: for (i = 0; i < map->count; i++) { if (map->map_ops[i].status == GNTST_okay) { map->unmap_ops[i].handle = map->map_ops[i].handle; if (!use_ptemod) alloced++; } if (use_ptemod) { if (map->kmap_ops[i].status == GNTST_okay) { if (map->map_ops[i].status == GNTST_okay) alloced++; map->kunmap_ops[i].handle = map->kmap_ops[i].handle; } } } ... atomic_add(alloced, &map->live_grants); Assume that use_ptemod is true (i.e., the domain mapping the granted pages is a paravirtualized domain). In the code excerpt above, note that the "alloced" variable is only incremented when both kmap_ops[i].status and map_ops[i].status are set to GNTST_okay (i.e., both mapping operations are successful). However, as also noted above, there are cases where a grant mapping operation fails partially, breaking the assumption of the code excerpt above. The aforementioned causes map->live_grants to be incorrectly set. In some cases, all of the map_ops mappings fail, but all of the kmap_ops mappings succeed, meaning that live_grants may remain zero. This in turn makes it impossible to unmap the successfully grant-mapped pages pointed to by kmap_ops, because unmap_grant_pages has the following snippet of code at its beginning: if (atomic_read(&map->live_grants) == 0) return; /* Nothing to do */ In other cases where only some of the map_ops mappings fail but all kmap_ops mappings succeed, live_grants is made positive, but when the user requests unmapping the grant-mapped pages, __unmap_grant_pages_done will then make map->live_grants negative, because the latter function does not check if all of the pages that were requested to be unmapped were actually unmapped, and the same function unconditionally subtracts "data->count" (i.e., a value that can be greater than map->live_grants) from map->live_grants. The side effects of a negative live_grants value have not been studied. The net effect of all of this is that grant references are leaked in one of the above conditions. In Qubes OS v4.1 (which uses Xen's grant mechanism extensively for X11 GUI isolation), this issue manifests itself with warning messages like the following to be printed out by the Linux kernel in the VM that had granted pages (that contain X11 GUI window data) to dom0: "g.e. 0x1234 still pending", especially after the user rapidly resizes GUI VM windows (causing some grant-mapping operations to partially or completely fail, due to the fact that the VM unshares some of the pages as part of the window resizing, making the pages impossible to grant-map from dom0). The fix for this issue involves counting all successful map_ops and kmap_ops mappings separately, and then adding the sum to live_grants. During unmapping, only the number of successfully unmapped grants is subtracted from live_grants. The code is also modified to check for negative live_grants values after the subtraction and warn the user.

Severity

No CVSS data available.

Assigner

Linux mitre root

References

9 references

URL	Tags
https://git.kernel.org/stable/c/b043f2cab100bed3e…
https://git.kernel.org/stable/c/49bb053b1ec367b68…
https://git.kernel.org/stable/c/cb1ccfe7655380f77…
https://git.kernel.org/stable/c/3d056d81b93a78761…
https://git.kernel.org/stable/c/49db6cb81400ba863…
https://git.kernel.org/stable/c/1cb73704cb4778299…
https://git.kernel.org/stable/c/0bccddd9b8f03ad57…
https://git.kernel.org/stable/c/273f6a4f71be12e2e…
https://git.kernel.org/stable/c/0991028cd49567d70…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 36cd49b071fceca70326d9db786aa15e9fffd677 , < b043f2cab100bed3e0a999dcf38cc05b1e4a7e41 (git) Affected: 2fe26a9a70482bea7827803fdec98050fec68b20 , < 49bb053b1ec367b6883030eb2cca696e91435679 (git) Affected: 73e9e72247b98da65bc32d41a961e820cca5f503 , < cb1ccfe7655380f77a58b340072f5f40bc285902 (git) Affected: ee25841221c17228cbd30262a90f3b03ad80cdf6 , < 3d056d81b93a787613eda44aeb21fc14c3392b34 (git) Affected: 79963021fd718b74bed4cbc98f5f49d3ba6fb48c , < 49db6cb81400ba863e1a85e55fcdf1031807c23f (git) Affected: 87a54feba68f5e47925c8e49100db9b2a8add761 , < 1cb73704cb4778299609634a790a80daba582f7d (git) Affected: dbe97cff7dd9f0f75c524afdd55ad46be3d15295 , < 0bccddd9b8f03ad57bb738f0d3da8845d4e1e579 (git) Affected: dbe97cff7dd9f0f75c524afdd55ad46be3d15295 , < 273f6a4f71be12e2ec80a4919837d6e4fa933a04 (git) Affected: dbe97cff7dd9f0f75c524afdd55ad46be3d15295 , < 0991028cd49567d7016d1b224fe0117c35059f86 (git) Affected: d4a49d20cd7cdb6bd075cd04c2cd00a7eba907ed (git) Affected: 4.9.322 , < 4.9.332 (semver) Affected: 4.14.287 , < 4.14.298 (semver) Affected: 4.19.251 , < 4.19.264 (semver) Affected: 5.4.204 , < 5.4.223 (semver) Affected: 5.10.129 , < 5.10.153 (semver) Affected: 5.15.51 , < 5.15.75 (semver) Affected: 5.18.8 , < 5.19 (semver)
Linux	Linux	Affected: 5.19 Unaffected: 0 , < 5.19 (semver) Unaffected: 4.9.332 , ≤ 4.9.* (semver) Unaffected: 4.14.298 , ≤ 4.14.* (semver) Unaffected: 4.19.264 , ≤ 4.19.* (semver) Unaffected: 5.4.223 , ≤ 5.4.* (semver) Unaffected: 5.10.153 , ≤ 5.10.* (semver) Unaffected: 5.15.75 , ≤ 5.15.* (semver) Unaffected: 5.19.17 , ≤ 5.19.* (semver) Unaffected: 6.0.3 , ≤ 6.0.* (semver) Unaffected: 6.1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/xen/gntdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b043f2cab100bed3e0a999dcf38cc05b1e4a7e41",
              "status": "affected",
              "version": "36cd49b071fceca70326d9db786aa15e9fffd677",
              "versionType": "git"
            },
            {
              "lessThan": "49bb053b1ec367b6883030eb2cca696e91435679",
              "status": "affected",
              "version": "2fe26a9a70482bea7827803fdec98050fec68b20",
              "versionType": "git"
            },
            {
              "lessThan": "cb1ccfe7655380f77a58b340072f5f40bc285902",
              "status": "affected",
              "version": "73e9e72247b98da65bc32d41a961e820cca5f503",
              "versionType": "git"
            },
            {
              "lessThan": "3d056d81b93a787613eda44aeb21fc14c3392b34",
              "status": "affected",
              "version": "ee25841221c17228cbd30262a90f3b03ad80cdf6",
              "versionType": "git"
            },
            {
              "lessThan": "49db6cb81400ba863e1a85e55fcdf1031807c23f",
              "status": "affected",
              "version": "79963021fd718b74bed4cbc98f5f49d3ba6fb48c",
              "versionType": "git"
            },
            {
              "lessThan": "1cb73704cb4778299609634a790a80daba582f7d",
              "status": "affected",
              "version": "87a54feba68f5e47925c8e49100db9b2a8add761",
              "versionType": "git"
            },
            {
              "lessThan": "0bccddd9b8f03ad57bb738f0d3da8845d4e1e579",
              "status": "affected",
              "version": "dbe97cff7dd9f0f75c524afdd55ad46be3d15295",
              "versionType": "git"
            },
            {
              "lessThan": "273f6a4f71be12e2ec80a4919837d6e4fa933a04",
              "status": "affected",
              "version": "dbe97cff7dd9f0f75c524afdd55ad46be3d15295",
              "versionType": "git"
            },
            {
              "lessThan": "0991028cd49567d7016d1b224fe0117c35059f86",
              "status": "affected",
              "version": "dbe97cff7dd9f0f75c524afdd55ad46be3d15295",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "d4a49d20cd7cdb6bd075cd04c2cd00a7eba907ed",
              "versionType": "git"
            },
            {
              "lessThan": "4.9.332",
              "status": "affected",
              "version": "4.9.322",
              "versionType": "semver"
            },
            {
              "lessThan": "4.14.298",
              "status": "affected",
              "version": "4.14.287",
              "versionType": "semver"
            },
            {
              "lessThan": "4.19.264",
              "status": "affected",
              "version": "4.19.251",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.223",
              "status": "affected",
              "version": "5.4.204",
              "versionType": "semver"
            },
            {
              "lessThan": "5.10.153",
              "status": "affected",
              "version": "5.10.129",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.75",
              "status": "affected",
              "version": "5.15.51",
              "versionType": "semver"
            },
            {
              "lessThan": "5.19",
              "status": "affected",
              "version": "5.18.8",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/xen/gntdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.19"
            },
            {
              "lessThan": "5.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.332",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.298",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.264",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.223",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.332",
                  "versionStartIncluding": "4.9.322",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.298",
                  "versionStartIncluding": "4.14.287",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.264",
                  "versionStartIncluding": "4.19.251",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.223",
                  "versionStartIncluding": "5.4.204",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.153",
                  "versionStartIncluding": "5.10.129",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "5.15.51",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.18.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/gntdev: Prevent leaking grants\n\nPrior to this commit, if a grant mapping operation failed partially,\nsome of the entries in the map_ops array would be invalid, whereas all\nof the entries in the kmap_ops array would be valid. This in turn would\ncause the following logic in gntdev_map_grant_pages to become invalid:\n\n  for (i = 0; i \u003c map-\u003ecount; i++) {\n    if (map-\u003emap_ops[i].status == GNTST_okay) {\n      map-\u003eunmap_ops[i].handle = map-\u003emap_ops[i].handle;\n      if (!use_ptemod)\n        alloced++;\n    }\n    if (use_ptemod) {\n      if (map-\u003ekmap_ops[i].status == GNTST_okay) {\n        if (map-\u003emap_ops[i].status == GNTST_okay)\n          alloced++;\n        map-\u003ekunmap_ops[i].handle = map-\u003ekmap_ops[i].handle;\n      }\n    }\n  }\n  ...\n  atomic_add(alloced, \u0026map-\u003elive_grants);\n\nAssume that use_ptemod is true (i.e., the domain mapping the granted\npages is a paravirtualized domain). In the code excerpt above, note that\nthe \"alloced\" variable is only incremented when both kmap_ops[i].status\nand map_ops[i].status are set to GNTST_okay (i.e., both mapping\noperations are successful).  However, as also noted above, there are\ncases where a grant mapping operation fails partially, breaking the\nassumption of the code excerpt above.\n\nThe aforementioned causes map-\u003elive_grants to be incorrectly set. In\nsome cases, all of the map_ops mappings fail, but all of the kmap_ops\nmappings succeed, meaning that live_grants may remain zero. This in turn\nmakes it impossible to unmap the successfully grant-mapped pages pointed\nto by kmap_ops, because unmap_grant_pages has the following snippet of\ncode at its beginning:\n\n  if (atomic_read(\u0026map-\u003elive_grants) == 0)\n    return; /* Nothing to do */\n\nIn other cases where only some of the map_ops mappings fail but all\nkmap_ops mappings succeed, live_grants is made positive, but when the\nuser requests unmapping the grant-mapped pages, __unmap_grant_pages_done\nwill then make map-\u003elive_grants negative, because the latter function\ndoes not check if all of the pages that were requested to be unmapped\nwere actually unmapped, and the same function unconditionally subtracts\n\"data-\u003ecount\" (i.e., a value that can be greater than map-\u003elive_grants)\nfrom map-\u003elive_grants. The side effects of a negative live_grants value\nhave not been studied.\n\nThe net effect of all of this is that grant references are leaked in one\nof the above conditions. In Qubes OS v4.1 (which uses Xen\u0027s grant\nmechanism extensively for X11 GUI isolation), this issue manifests\nitself with warning messages like the following to be printed out by the\nLinux kernel in the VM that had granted pages (that contain X11 GUI\nwindow data) to dom0: \"g.e. 0x1234 still pending\", especially after the\nuser rapidly resizes GUI VM windows (causing some grant-mapping\noperations to partially or completely fail, due to the fact that the VM\nunshares some of the pages as part of the window resizing, making the\npages impossible to grant-map from dom0).\n\nThe fix for this issue involves counting all successful map_ops and\nkmap_ops mappings separately, and then adding the sum to live_grants.\nDuring unmapping, only the number of successfully unmapped grants is\nsubtracted from live_grants. The code is also modified to check for\nnegative live_grants values after the subtraction and warn the user."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:23:58.804Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b043f2cab100bed3e0a999dcf38cc05b1e4a7e41"
        },
        {
          "url": "https://git.kernel.org/stable/c/49bb053b1ec367b6883030eb2cca696e91435679"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb1ccfe7655380f77a58b340072f5f40bc285902"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d056d81b93a787613eda44aeb21fc14c3392b34"
        },
        {
          "url": "https://git.kernel.org/stable/c/49db6cb81400ba863e1a85e55fcdf1031807c23f"
        },
        {
          "url": "https://git.kernel.org/stable/c/1cb73704cb4778299609634a790a80daba582f7d"
        },
        {
          "url": "https://git.kernel.org/stable/c/0bccddd9b8f03ad57bb738f0d3da8845d4e1e579"
        },
        {
          "url": "https://git.kernel.org/stable/c/273f6a4f71be12e2ec80a4919837d6e4fa933a04"
        },
        {
          "url": "https://git.kernel.org/stable/c/0991028cd49567d7016d1b224fe0117c35059f86"
        }
      ],
      "title": "xen/gntdev: Prevent leaking grants",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50257",
    "datePublished": "2025-09-15T14:02:42.986Z",
    "dateReserved": "2025-09-15T13:58:00.973Z",
    "dateUpdated": "2026-05-23T15:23:58.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2026-08845 (CVE-2022-50257)

CVE-2022-50257 (GCVE-0-2022-50257)

Tags

Sightings

Nomenclature

Related by attack behaviour