GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50221 (GCVE-0-2022-50221)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:03 – Updated: 2026-08-05 08:57
VLAI
Title
drm/fb-helper: Fix out-of-bounds access
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: Fix out-of-bounds access Clip memory range to screen-buffer size to avoid out-of-bounds access in fbdev deferred I/O's damage handling. Fbdev's deferred I/O can only track pages. From the range of pages, the damage handler computes the clipping rectangle for the display update. If the fbdev screen buffer ends near the beginning of a page, that page could contain more scanlines. The damage handler would then track these non-existing scanlines as dirty and provoke an out-of-bounds access during the screen update. Hence, clip the maximum memory range to the size of the screen buffer. While at it, rename the variables min/max to min_off/max_off in drm_fb_helper_deferred_io(). This avoids confusion with the macros of the same name.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 67b723f5b74254d27962b1b59bddfee1584575ff , < 9c49ac792c639dbec0728b513329a32461f72253 (git)
Affected: 67b723f5b74254d27962b1b59bddfee1584575ff , < ae25885bdf59fde40726863c57fd20e4a0642183 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 5.19.2 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_fb_helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9c49ac792c639dbec0728b513329a32461f72253",
              "status": "affected",
              "version": "67b723f5b74254d27962b1b59bddfee1584575ff",
              "versionType": "git"
            },
            {
              "lessThan": "ae25885bdf59fde40726863c57fd20e4a0642183",
              "status": "affected",
              "version": "67b723f5b74254d27962b1b59bddfee1584575ff",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/drm_fb_helper.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.2",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/fb-helper: Fix out-of-bounds access\n\nClip memory range to screen-buffer size to avoid out-of-bounds access\nin fbdev deferred I/O\u0027s damage handling.\n\nFbdev\u0027s deferred I/O can only track pages. From the range of pages, the\ndamage handler computes the clipping rectangle for the display update.\nIf the fbdev screen buffer ends near the beginning of a page, that page\ncould contain more scanlines. The damage handler would then track these\nnon-existing scanlines as dirty and provoke an out-of-bounds access\nduring the screen update. Hence, clip the maximum memory range to the\nsize of the screen buffer.\n\nWhile at it, rename the variables min/max to min_off/max_off in\ndrm_fb_helper_deferred_io(). This avoids confusion with the macros of\nthe same name."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached by opening /dev/fbN, mmap\u0027ing the fbdev shadow buffer, and dirtying pages so fb_deferred_io_work calls drm_fb_helper_deferred_io(); that is a local device/syscall path with no network or adjacent-protocol entry.\nAC:L - On affected shadow-fbdev configurations whose screen_size is not page-aligned (common modes such as 1366x768x32), writing the last mapped page and flushing deferred I/O (or fsync) reliably enlarges the damage clip past the buffer; no race or attacker-uncontrollable layout is required.\nPR:L - fb_open() has no capability check; access is DAC on /dev/fbN (typically 660 root:video), which ordinary desktop, Android, and embedded graphics users hold via the video group\u2014basic local privileges, not real root.\nUI:N - The attacker opens the framebuffer, mmaps it, and dirties the last page themselves; no separate victim action is required.\nS:U - Corruption stays in host kernel vmalloc/GEM memory under the same OS authority; this is not a VM escape, IOMMU bypass, or other cross-boundary impact.\nC:H - drm_fb_helper_damage_blit_real() reads past the vzalloc\u0027d shadow buffer into adjacent kernel memory (often kilobytes for a full extra scanline), an out-of-bounds read well beyond a few bytes that can disclose neighboring contents into the blit/display path.\nI:H - The same oversized clip drives iosys_map_memcpy_to() past the logical framebuffer into memory beyond the page-aligned GEM allocation (e.g. ~3KB past the BO for 1366x768x32), a kernel out-of-bounds write exploitable for heap corruption/control-flow impact.\nA:H - Accesses past the shadow/GEM allocations into unmapped vmalloc/guard regions can oops or panic the kernel, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:57:46.137Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9c49ac792c639dbec0728b513329a32461f72253"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae25885bdf59fde40726863c57fd20e4a0642183"
        }
      ],
      "title": "drm/fb-helper: Fix out-of-bounds access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50221",
    "datePublished": "2025-06-18T11:03:56.096Z",
    "dateReserved": "2025-06-18T10:57:27.430Z",
    "dateUpdated": "2026-08-05T08:57:46.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50221",
      "date": "2026-09-15",
      "epss": "0.00198",
      "percentile": "0.09814"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50221\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:53.090\",\"lastModified\":\"2026-08-04T10:18:07.687\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/fb-helper: Fix out-of-bounds access\\n\\nClip memory range to screen-buffer size to avoid out-of-bounds access\\nin fbdev deferred I/O\u0027s damage handling.\\n\\nFbdev\u0027s deferred I/O can only track pages. From the range of pages, the\\ndamage handler computes the clipping rectangle for the display update.\\nIf the fbdev screen buffer ends near the beginning of a page, that page\\ncould contain more scanlines. The damage handler would then track these\\nnon-existing scanlines as dirty and provoke an out-of-bounds access\\nduring the screen update. Hence, clip the maximum memory range to the\\nsize of the screen buffer.\\n\\nWhile at it, rename the variables min/max to min_off/max_off in\\ndrm_fb_helper_deferred_io(). This avoids confusion with the macros of\\nthe same name.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/fb-helper: Arregla el acceso fuera de los l\u00edmites Recorta el rango de memoria al tama\u00f1o del b\u00fafer de pantalla para evitar el acceso fuera de los l\u00edmites en el manejo de da\u00f1os de E/S diferidas de fbdev. La E/S diferida de fbdev solo puede rastrear p\u00e1ginas. A partir del rango de p\u00e1ginas, el controlador de da\u00f1os calcula el rect\u00e1ngulo de recorte para la actualizaci\u00f3n de la pantalla. Si el b\u00fafer de pantalla de fbdev termina cerca del principio de una p\u00e1gina, esa p\u00e1gina podr\u00eda contener m\u00e1s l\u00edneas de exploraci\u00f3n. El controlador de da\u00f1os rastrear\u00eda entonces estas l\u00edneas de exploraci\u00f3n inexistentes como sucias y provocar\u00eda un acceso fuera de los l\u00edmites durante la actualizaci\u00f3n de la pantalla. Por lo tanto, recorta el rango m\u00e1ximo de memoria al tama\u00f1o del b\u00fafer de pantalla. Mientras lo haces, cambia el nombre de las variables min/max a min_off/max_off en drm_fb_helper_deferred_io(). Esto evita confusiones con las macros del mismo nombre.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/drm_fb_helper.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"67b723f5b74254d27962b1b59bddfee1584575ff\",\"lessThan\":\"9c49ac792c639dbec0728b513329a32461f72253\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"67b723f5b74254d27962b1b59bddfee1584575ff\",\"lessThan\":\"ae25885bdf59fde40726863c57fd20e4a0642183\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/drm_fb_helper.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.2\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.19.2\",\"matchCriteriaId\":\"9DDA808D-1762-4306-BFCC-F1E9219F4F14\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/9c49ac792c639dbec0728b513329a32461f72253\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ae25885bdf59fde40726863c57fd20e4a0642183\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:38:40+00:00",
      "cve": "CVE-2022-50221",
      "id": "CVE-2022-50221",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "321",
      "product_status:known_affected": "38",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/fb-helper: Fix out-of-bounds access",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50221.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:22:31Z",
      "cve": "CVE-2022-50221",
      "id": "CVE-2022-50221",
      "initial_release_date": "2025-06-19T03:38:46Z",
      "product_status:known_affected": "369",
      "product_status:known_not_affected": "444",
      "product_status:recommended": "139",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50221",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50221.json",
      "version": "35"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.