CVE-2022-50255 (GCVE-0-2022-50255)
Vulnerability from cvelistv5
Published
2025-09-15 14:02
Modified
2025-09-15 14:02
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix reading strings from synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]' > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is that the synthetic event field "char file[]" will read the value given to it as a string without any memory checks to make sure the address is valid. The above example will pass in the user space address and the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that can read strings safely (and actually succeed when the address is from user space and the memory is mapped in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0934ae9977c27133449b6dd8c6213970e7eece38
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/149198d0b884e4606ed1d29b330c70016d878276
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d9c79fbcbdb6cb10c07c85040eaf615180b26c48
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f8bae1853196b52ede50950387f5b48cf83b9815
Impacted products
Vendor Product Version
Linux Linux Version: bd82631d7ccdc894af2738e47abcba2cb6e7dea9
Version: bd82631d7ccdc894af2738e47abcba2cb6e7dea9
Version: bd82631d7ccdc894af2738e47abcba2cb6e7dea9
Version: bd82631d7ccdc894af2738e47abcba2cb6e7dea9
 Create a notification for this product.
   Linux Linux Version: 5.10
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_synth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d9c79fbcbdb6cb10c07c85040eaf615180b26c48",
              "status": "affected",
              "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9",
              "versionType": "git"
            },
            {
              "lessThan": "149198d0b884e4606ed1d29b330c70016d878276",
              "status": "affected",
              "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9",
              "versionType": "git"
            },
            {
              "lessThan": "f8bae1853196b52ede50950387f5b48cf83b9815",
              "status": "affected",
              "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9",
              "versionType": "git"
            },
            {
              "lessThan": "0934ae9977c27133449b6dd8c6213970e7eece38",
              "status": "affected",
              "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_synth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix reading strings from synthetic events\n\nThe follow commands caused a crash:\n\n  # cd /sys/kernel/tracing\n  # echo \u0027s:open char file[]\u0027 \u003e dynamic_events\n  # echo \u0027hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)\u0027 \u003e events/syscalls/sys_enter_openat/trigger\u0027\n  # echo 1 \u003e events/synthetic/open/enable\n\nBOOM!\n\nThe problem is that the synthetic event field \"char file[]\" will read\nthe value given to it as a string without any memory checks to make sure\nthe address is valid. The above example will pass in the user space\naddress and the sythetic event code will happily call strlen() on it\nand then strscpy() where either one will cause an oops when accessing\nuser space addresses.\n\nUse the helper functions from trace_kprobe and trace_eprobe that can\nread strings safely (and actually succeed when the address is from user\nspace and the memory is mapped in).\n\nNow the above can show:\n\n     packagekitd-1721    [000] ...2.   104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr\n    in:imjournal-978     [006] ...2.   104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp\n     packagekitd-1721    [000] ...2.   104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T14:02:37.224Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d9c79fbcbdb6cb10c07c85040eaf615180b26c48"
        },
        {
          "url": "https://git.kernel.org/stable/c/149198d0b884e4606ed1d29b330c70016d878276"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8bae1853196b52ede50950387f5b48cf83b9815"
        },
        {
          "url": "https://git.kernel.org/stable/c/0934ae9977c27133449b6dd8c6213970e7eece38"
        }
      ],
      "title": "tracing: Fix reading strings from synthetic events",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50255",
    "datePublished": "2025-09-15T14:02:37.224Z",
    "dateReserved": "2025-09-15T13:58:00.973Z",
    "dateUpdated": "2025-09-15T14:02:37.224Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50255\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-15T14:15:36.247\",\"lastModified\":\"2025-09-15T15:21:42.937\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing: Fix reading strings from synthetic events\\n\\nThe follow commands caused a crash:\\n\\n  # cd /sys/kernel/tracing\\n  # echo \u0027s:open char file[]\u0027 \u003e dynamic_events\\n  # echo \u0027hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)\u0027 \u003e events/syscalls/sys_enter_openat/trigger\u0027\\n  # echo 1 \u003e events/synthetic/open/enable\\n\\nBOOM!\\n\\nThe problem is that the synthetic event field \\\"char file[]\\\" will read\\nthe value given to it as a string without any memory checks to make sure\\nthe address is valid. The above example will pass in the user space\\naddress and the sythetic event code will happily call strlen() on it\\nand then strscpy() where either one will cause an oops when accessing\\nuser space addresses.\\n\\nUse the helper functions from trace_kprobe and trace_eprobe that can\\nread strings safely (and actually succeed when the address is from user\\nspace and the memory is mapped in).\\n\\nNow the above can show:\\n\\n     packagekitd-1721    [000] ...2.   104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr\\n    in:imjournal-978     [006] ...2.   104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp\\n     packagekitd-1721    [000] ...2.   104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0934ae9977c27133449b6dd8c6213970e7eece38\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/149198d0b884e4606ed1d29b330c70016d878276\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d9c79fbcbdb6cb10c07c85040eaf615180b26c48\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f8bae1853196b52ede50950387f5b48cf83b9815\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.