CVE-2022-50317 (GCVE-0-2022-50317)
Vulnerability from cvelistv5
Published
2025-09-15 14:48
Modified
2025-09-15 14:48
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: megachips: Fix a null pointer dereference bug When removing the module we will get the following warning: [ 31.911505] i2c-core: driver [stdp2690-ge-b850v3-fw] unregistered [ 31.912484] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI [ 31.913338] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 31.915280] RIP: 0010:drm_bridge_remove+0x97/0x130 [ 31.921825] Call Trace: [ 31.922533] stdp4028_ge_b850v3_fw_remove+0x34/0x60 [megachips_stdpxxxx_ge_b850v3_fw] [ 31.923139] i2c_device_remove+0x181/0x1f0 The two bridges (stdp2690, stdp4028) do not probe at the same time, so the driver does not call ge_b850v3_resgiter() when probing, causing the driver to try to remove the object that has not been initialized. Fix this by checking whether both the bridges are probed.
References
Impacted products
Vendor Product Version
Linux Linux Version: 7649972d97fb98578fbc4a351416cf72895e7c4d
Version: 16e3827904932eccfba0915f0c93b519de3536ac
Version: 50ad94f8654a53ec9ca3604a7a23cbaf166e0119
Version: b8d10f601f226f055df8b5368d7ea7f369136cd5
Version: 405856460d3e7aefb7c1aef047ec88fc4ef2e2a5
Version: 11632d4aa2b3f126790e81a4415d6c23103cf8bb
Version: 11632d4aa2b3f126790e81a4415d6c23103cf8bb
Version: 11632d4aa2b3f126790e81a4415d6c23103cf8bb
Version: e449461989f0674f188d30494ffd3f5ba74c1a05
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "aaa512ad1e59f2edf8a9e4f2b167a44b24670679",
              "status": "affected",
              "version": "7649972d97fb98578fbc4a351416cf72895e7c4d",
              "versionType": "git"
            },
            {
              "lessThan": "5bc20bafcd87ba0858ab772cefc7047cb51bc249",
              "status": "affected",
              "version": "16e3827904932eccfba0915f0c93b519de3536ac",
              "versionType": "git"
            },
            {
              "lessThan": "1daf69228e310938177119c4eadcd30fc75c81e0",
              "status": "affected",
              "version": "50ad94f8654a53ec9ca3604a7a23cbaf166e0119",
              "versionType": "git"
            },
            {
              "lessThan": "877e92e9b1bdeb580b31a46061005936be902cd4",
              "status": "affected",
              "version": "b8d10f601f226f055df8b5368d7ea7f369136cd5",
              "versionType": "git"
            },
            {
              "lessThan": "4610e7a4111fa3f3ce27c09d6d94008c55f1cd31",
              "status": "affected",
              "version": "405856460d3e7aefb7c1aef047ec88fc4ef2e2a5",
              "versionType": "git"
            },
            {
              "lessThan": "21764467ab396d9f08921e0a5ffa1214244e1ad9",
              "status": "affected",
              "version": "11632d4aa2b3f126790e81a4415d6c23103cf8bb",
              "versionType": "git"
            },
            {
              "lessThan": "7371fad5cfe6eada6bb5523c895fd6074b15c2b9",
              "status": "affected",
              "version": "11632d4aa2b3f126790e81a4415d6c23103cf8bb",
              "versionType": "git"
            },
            {
              "lessThan": "1ff673333d46d2c1b053ebd0c1c7c7c79e36943e",
              "status": "affected",
              "version": "11632d4aa2b3f126790e81a4415d6c23103cf8bb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e449461989f0674f188d30494ffd3f5ba74c1a05",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/bridge/megachips-stdpxxxx-ge-b850v3-fw.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.296",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.262",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.220",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.296",
                  "versionStartIncluding": "4.14.263",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.262",
                  "versionStartIncluding": "4.19.226",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.220",
                  "versionStartIncluding": "5.4.174",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.150",
                  "versionStartIncluding": "5.10.94",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "5.15.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/bridge: megachips: Fix a null pointer dereference bug\n\nWhen removing the module we will get the following warning:\n\n[   31.911505] i2c-core: driver [stdp2690-ge-b850v3-fw] unregistered\n[   31.912484] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI\n[   31.913338] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\n[   31.915280] RIP: 0010:drm_bridge_remove+0x97/0x130\n[   31.921825] Call Trace:\n[   31.922533]  stdp4028_ge_b850v3_fw_remove+0x34/0x60 [megachips_stdpxxxx_ge_b850v3_fw]\n[   31.923139]  i2c_device_remove+0x181/0x1f0\n\nThe two bridges (stdp2690, stdp4028) do not probe at the same time, so\nthe driver does not call ge_b850v3_resgiter() when probing, causing the\ndriver to try to remove the object that has not been initialized.\n\nFix this by checking whether both the bridges are probed."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T14:48:50.167Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/aaa512ad1e59f2edf8a9e4f2b167a44b24670679"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bc20bafcd87ba0858ab772cefc7047cb51bc249"
        },
        {
          "url": "https://git.kernel.org/stable/c/1daf69228e310938177119c4eadcd30fc75c81e0"
        },
        {
          "url": "https://git.kernel.org/stable/c/877e92e9b1bdeb580b31a46061005936be902cd4"
        },
        {
          "url": "https://git.kernel.org/stable/c/4610e7a4111fa3f3ce27c09d6d94008c55f1cd31"
        },
        {
          "url": "https://git.kernel.org/stable/c/21764467ab396d9f08921e0a5ffa1214244e1ad9"
        },
        {
          "url": "https://git.kernel.org/stable/c/7371fad5cfe6eada6bb5523c895fd6074b15c2b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ff673333d46d2c1b053ebd0c1c7c7c79e36943e"
        }
      ],
      "title": "drm/bridge: megachips: Fix a null pointer dereference bug",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50317",
    "datePublished": "2025-09-15T14:48:50.167Z",
    "dateReserved": "2025-09-15T14:18:36.814Z",
    "dateUpdated": "2025-09-15T14:48:50.167Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.