CVE-2022-50255 (GCVE-0-2022-50255)
Vulnerability from cvelistv5
Published
2025-09-15 14:02
Modified
2026-08-05 08:57
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix reading strings from synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]' > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is that the synthetic event field "char file[]" will read the value given to it as a string without any memory checks to make sure the address is valid. The above example will pass in the user space address and the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that can read strings safely (and actually succeed when the address is from user space and the memory is mapped in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr
References
Impacted products
Vendor Product Version
Linux Linux Version: bd82631d7ccdc894af2738e47abcba2cb6e7dea9
Version: bd82631d7ccdc894af2738e47abcba2cb6e7dea9
Version: bd82631d7ccdc894af2738e47abcba2cb6e7dea9
Version: bd82631d7ccdc894af2738e47abcba2cb6e7dea9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_synth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d9c79fbcbdb6cb10c07c85040eaf615180b26c48",
              "status": "affected",
              "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9",
              "versionType": "git"
            },
            {
              "lessThan": "149198d0b884e4606ed1d29b330c70016d878276",
              "status": "affected",
              "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9",
              "versionType": "git"
            },
            {
              "lessThan": "f8bae1853196b52ede50950387f5b48cf83b9815",
              "status": "affected",
              "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9",
              "versionType": "git"
            },
            {
              "lessThan": "0934ae9977c27133449b6dd8c6213970e7eece38",
              "status": "affected",
              "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_synth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix reading strings from synthetic events\n\nThe follow commands caused a crash:\n\n  # cd /sys/kernel/tracing\n  # echo \u0027s:open char file[]\u0027 \u003e dynamic_events\n  # echo \u0027hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)\u0027 \u003e events/syscalls/sys_enter_openat/trigger\u0027\n  # echo 1 \u003e events/synthetic/open/enable\n\nBOOM!\n\nThe problem is that the synthetic event field \"char file[]\" will read\nthe value given to it as a string without any memory checks to make sure\nthe address is valid. The above example will pass in the user space\naddress and the sythetic event code will happily call strlen() on it\nand then strscpy() where either one will cause an oops when accessing\nuser space addresses.\n\nUse the helper functions from trace_kprobe and trace_eprobe that can\nread strings safely (and actually succeed when the address is from user\nspace and the memory is mapped in).\n\nNow the above can show:\n\n     packagekitd-1721    [000] ...2.   104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr\n    in:imjournal-978     [006] ...2.   104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp\n     packagekitd-1721    [000] ...2.   104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only by writing synthetic-event and hist-trigger commands to local tracefs (`dynamic_events` / `events/*/trigger`) and then hitting the armed tracepoint via local syscalls; there is no network or adjacent-protocol path into `trace_event_raw_event_synth()` / `trace_string()`.\nAC:L - The upstream reproducer is a deterministic sequence of tracefs writes plus ordinary syscalls (e.g. openat); no race or attacker-uncontrollable layout is required for the oops, and for the ring-buffer over-copy path the attacker fully controls both threads mutating the source string.\nPR:L - There is no capable() gate on this path\u2014access is pure tracefs DAC (0640), routinely delegated to non-root principals (Android/Perfetto, ChromeOS debugd, gid=-mounted tracing groups), matching established PR:L scoring for hist/synthetic tracefs bugs.\nUI:N - The attacker creates the synthetic event, installs the hist trigger, enables it, and fires the traced syscall themselves; no separate victim action is required.\nS:U - Impact stays inside the host kernel tracing/ring-buffer authority; this is not a VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:H - Syscall `const char *` fields are stored as raw pointers and then strlen/strscpy\u0027d into the synthetic event; an attacker can pass kernel addresses as syscall arguments so arbitrary NUL-terminated kernel memory is copied into the readable trace buffer.\nI:H - Event size is computed with one strlen and the copy uses a second strlen/strscpy; a concurrent attacker-controlled mutation of the source string yields an out-of-bounds write past the reserved ring-buffer entry, a heap corruption primitive.\nA:H - strlen/strscpy on an unmapped or SMAP-protected address causes a reliable kernel oops/panic (the documented BOOM!), fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:57:58.020Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d9c79fbcbdb6cb10c07c85040eaf615180b26c48"
        },
        {
          "url": "https://git.kernel.org/stable/c/149198d0b884e4606ed1d29b330c70016d878276"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8bae1853196b52ede50950387f5b48cf83b9815"
        },
        {
          "url": "https://git.kernel.org/stable/c/0934ae9977c27133449b6dd8c6213970e7eece38"
        }
      ],
      "title": "tracing: Fix reading strings from synthetic events",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50255",
    "datePublished": "2025-09-15T14:02:37.224Z",
    "dateReserved": "2025-09-15T13:58:00.973Z",
    "dateUpdated": "2026-08-05T08:57:58.020Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.