GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50677 (GCVE-0-2022-50677)

Vulnerability from cvelistv5 – Published: 2025-12-09 01:29 – Updated: 2026-08-05 08:59
VLAI
Title
ipmi: fix use after free in _ipmi_destroy_user()
Summary
In the Linux kernel, the following vulnerability has been resolved: ipmi: fix use after free in _ipmi_destroy_user() The intf_free() function frees the "intf" pointer so we cannot dereference it again on the next line.
Severity
7 (High)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f9d405a4bd6090ffbf3bba5e2da6b44c0e013cb3 , < 35ad87bfe330f7ef6a19f772223c63296d643172 (git)
Affected: b642ced2cad496c32ae1f62b85fc395391190820 , < d23006f2a56e11a3103de0ca8b843bf7fd7d76fc (git)
Affected: cbb79863fc3175ed5ac506465948b02a893a8235 , < f29d127b372e1b7662397d92341d9f7de198ff99 (git)
Affected: cbb79863fc3175ed5ac506465948b02a893a8235 , < bfce073089cb81482521c65061835aaa6d1a6cc0 (git)
Affected: cbb79863fc3175ed5ac506465948b02a893a8235 , < f7fde441198a9ecb130c3ccec91ee2131d6998ee (git)
Affected: cbb79863fc3175ed5ac506465948b02a893a8235 , < 1fc9b20a7688000fcf4d7fbaa58e415a3cdda961 (git)
Affected: cbb79863fc3175ed5ac506465948b02a893a8235 , < a92ce570c81dc0feaeb12a429b4bc65686d17967 (git)
Affected: 4.19.92 , < 4.19.270 (semver)
Affected: 5.4.7 , < 5.4.229 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 5.5
Unaffected: 0 , < 5.5 (semver)
Unaffected: 4.19.270 , ≤ 4.19.* (semver)
Unaffected: 5.4.229 , ≤ 5.4.* (semver)
Unaffected: 5.10.163 , ≤ 5.10.* (semver)
Unaffected: 5.15.87 , ≤ 5.15.* (semver)
Unaffected: 6.0.18 , ≤ 6.0.* (semver)
Unaffected: 6.1.4 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/ipmi/ipmi_msghandler.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "35ad87bfe330f7ef6a19f772223c63296d643172",
              "status": "affected",
              "version": "f9d405a4bd6090ffbf3bba5e2da6b44c0e013cb3",
              "versionType": "git"
            },
            {
              "lessThan": "d23006f2a56e11a3103de0ca8b843bf7fd7d76fc",
              "status": "affected",
              "version": "b642ced2cad496c32ae1f62b85fc395391190820",
              "versionType": "git"
            },
            {
              "lessThan": "f29d127b372e1b7662397d92341d9f7de198ff99",
              "status": "affected",
              "version": "cbb79863fc3175ed5ac506465948b02a893a8235",
              "versionType": "git"
            },
            {
              "lessThan": "bfce073089cb81482521c65061835aaa6d1a6cc0",
              "status": "affected",
              "version": "cbb79863fc3175ed5ac506465948b02a893a8235",
              "versionType": "git"
            },
            {
              "lessThan": "f7fde441198a9ecb130c3ccec91ee2131d6998ee",
              "status": "affected",
              "version": "cbb79863fc3175ed5ac506465948b02a893a8235",
              "versionType": "git"
            },
            {
              "lessThan": "1fc9b20a7688000fcf4d7fbaa58e415a3cdda961",
              "status": "affected",
              "version": "cbb79863fc3175ed5ac506465948b02a893a8235",
              "versionType": "git"
            },
            {
              "lessThan": "a92ce570c81dc0feaeb12a429b4bc65686d17967",
              "status": "affected",
              "version": "cbb79863fc3175ed5ac506465948b02a893a8235",
              "versionType": "git"
            },
            {
              "lessThan": "4.19.270",
              "status": "affected",
              "version": "4.19.92",
              "versionType": "semver"
            },
            {
              "lessThan": "5.4.229",
              "status": "affected",
              "version": "5.4.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/ipmi/ipmi_msghandler.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.18",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.270",
                  "versionStartIncluding": "4.19.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.229",
                  "versionStartIncluding": "5.4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.87",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.18",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.4",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: fix use after free in _ipmi_destroy_user()\n\nThe intf_free() function frees the \"intf\" pointer so we cannot\ndereference it again on the next line."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached by destroying an IPMI user via the local character-device path (close/release on /dev/ipmiN \u2192 ipmi_destroy_user \u2192 _ipmi_destroy_user) or the same teardown during local SMI unregister; no remote or adjacent packet path reaches this code.\nAC:H - module_put(intf-\u003eowner) only uses freed memory when intf is actually freed in the narrow window after the user kref_put and before that module_put, which requires a concurrent last-ref drop from ipmi_unregister_smi (rmmod/sysfs unbind/hot-remove) that a /dev/ipmi-only attacker cannot start.\nPR:L - ipmi_open/ipmi_create_user perform no capable() check; access is only gated by /dev/ipmiN DAC, and server/appliance deployments routinely grant that node to a non-root management group for ipmitool/freeipmi, matching established IPMI scoring.\nUI:N - The attacker drives open/close on their own IPMI fd; any concurrent unregister is an environmental teardown condition counted under Attack Complexity, not a separate victim interaction.\nS:U - This is a host-kernel heap use-after-free of struct ipmi_smi within the same OS security authority, with no VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - After intf_free kfree()s the ipmi_smi, module_put(intf-\u003eowner) reads the owner pointer from freed slab (owner is the first field); reclaim/spray of that object yields an attacker-influenced pointer and a kernel read primitive, so confidentiality is High per UAF guidance.\nI:H - module_put() then performs atomic refcount updates through that stale/reclaimed module pointer, giving a write-into-freed-memory / decrement primitive that can corrupt module state or sprayed heap and enable control-flow hijack.\nA:H - Dereferencing the freed ipmi_smi for intf-\u003eowner readily oopses under poisoning/init_on_free/KASAN, and a corrupted module_put path can WARN/panic (panic_on_oops/warn), so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:23.537Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/35ad87bfe330f7ef6a19f772223c63296d643172"
        },
        {
          "url": "https://git.kernel.org/stable/c/d23006f2a56e11a3103de0ca8b843bf7fd7d76fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/f29d127b372e1b7662397d92341d9f7de198ff99"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfce073089cb81482521c65061835aaa6d1a6cc0"
        },
        {
          "url": "https://git.kernel.org/stable/c/f7fde441198a9ecb130c3ccec91ee2131d6998ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fc9b20a7688000fcf4d7fbaa58e415a3cdda961"
        },
        {
          "url": "https://git.kernel.org/stable/c/a92ce570c81dc0feaeb12a429b4bc65686d17967"
        }
      ],
      "title": "ipmi: fix use after free in _ipmi_destroy_user()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50677",
    "datePublished": "2025-12-09T01:29:30.418Z",
    "dateReserved": "2025-12-09T01:26:45.991Z",
    "dateUpdated": "2026-08-05T08:59:23.537Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50677",
      "date": "2026-09-19",
      "epss": "0.00172",
      "percentile": "0.06969"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/char/ipmi/ipmi_msghandler.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "35ad87bfe330f7ef6a19f772223c63296d643172",
                    "status": "affected",
                    "version": "f9d405a4bd6090ffbf3bba5e2da6b44c0e013cb3",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d23006f2a56e11a3103de0ca8b843bf7fd7d76fc",
                    "status": "affected",
                    "version": "b642ced2cad496c32ae1f62b85fc395391190820",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f29d127b372e1b7662397d92341d9f7de198ff99",
                    "status": "affected",
                    "version": "cbb79863fc3175ed5ac506465948b02a893a8235",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bfce073089cb81482521c65061835aaa6d1a6cc0",
                    "status": "affected",
                    "version": "cbb79863fc3175ed5ac506465948b02a893a8235",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f7fde441198a9ecb130c3ccec91ee2131d6998ee",
                    "status": "affected",
                    "version": "cbb79863fc3175ed5ac506465948b02a893a8235",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1fc9b20a7688000fcf4d7fbaa58e415a3cdda961",
                    "status": "affected",
                    "version": "cbb79863fc3175ed5ac506465948b02a893a8235",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a92ce570c81dc0feaeb12a429b4bc65686d17967",
                    "status": "affected",
                    "version": "cbb79863fc3175ed5ac506465948b02a893a8235",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4.19.270",
                    "status": "affected",
                    "version": "4.19.92",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "5.4.229",
                    "status": "affected",
                    "version": "5.4.7",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/char/ipmi/ipmi_msghandler.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.5"
                  },
                  {
                    "lessThan": "5.5",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.229",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.163",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.87",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.18",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: fix use after free in _ipmi_destroy_user()\n\nThe intf_free() function frees the \"intf\" pointer so we cannot\ndereference it again on the next line."
          }
        ],
        "id": "CVE-2022-50677",
        "lastModified": "2026-08-04T10:18:21.390",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.0,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.0,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-09T16:17:19.967",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1fc9b20a7688000fcf4d7fbaa58e415a3cdda961"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/35ad87bfe330f7ef6a19f772223c63296d643172"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a92ce570c81dc0feaeb12a429b4bc65686d17967"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bfce073089cb81482521c65061835aaa6d1a6cc0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d23006f2a56e11a3103de0ca8b843bf7fd7d76fc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f29d127b372e1b7662397d92341d9f7de198ff99"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f7fde441198a9ecb130c3ccec91ee2131d6998ee"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:37:36+00:00",
      "cve": "CVE-2022-50677",
      "id": "CVE-2022-50677",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "240",
      "product_status:known_affected": "124",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipmi: fix use after free in _ipmi_destroy_user()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50677.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:19:29Z",
      "cve": "CVE-2022-50677",
      "id": "CVE-2022-50677",
      "initial_release_date": "2025-12-10T00:38:08Z",
      "product_status:known_affected": "454",
      "product_status:known_not_affected": "229",
      "product_status:recommended": "268",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50677",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50677.json",
      "version": "29"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.