CVE-2022-50417 (GCVE-0-2022-50417)
Vulnerability from cvelistv5
Published
2025-09-18 16:04
Modified
2026-08-05 08:58
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/panfrost: Fix GEM handle creation ref-counting panfrost_gem_create_with_handle() previously returned a BO but with the only reference being from the handle, which user space could in theory guess and release, causing a use-after-free. Additionally if the call to panfrost_gem_mapping_get() in panfrost_ioctl_create_bo() failed then a(nother) reference on the BO was dropped. The _create_with_handle() is a problematic pattern, so ditch it and instead create the handle in panfrost_ioctl_create_bo(). If the call to panfrost_gem_mapping_get() fails then this means that user space has indeed gone behind our back and freed the handle. In which case just return an error code.
References
Impacted products
Vendor Product Version
Linux Linux Version: f3ba91228e8e917e5bd6c4b72bfe846933d17370
Version: f3ba91228e8e917e5bd6c4b72bfe846933d17370
Version: f3ba91228e8e917e5bd6c4b72bfe846933d17370
Version: f3ba91228e8e917e5bd6c4b72bfe846933d17370
Version: f3ba91228e8e917e5bd6c4b72bfe846933d17370
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-50417",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:10:45.262200Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:13:09.937Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panfrost/panfrost_drv.c",
            "drivers/gpu/drm/panfrost/panfrost_gem.c",
            "drivers/gpu/drm/panfrost/panfrost_gem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c",
              "status": "affected",
              "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
              "versionType": "git"
            },
            {
              "lessThan": "4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a",
              "status": "affected",
              "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
              "versionType": "git"
            },
            {
              "lessThan": "3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2",
              "status": "affected",
              "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
              "versionType": "git"
            },
            {
              "lessThan": "ba3d2c2380e7129b525a787489c0b7e819a3b898",
              "status": "affected",
              "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
              "versionType": "git"
            },
            {
              "lessThan": "4217c6ac817451d5116687f3cc6286220dc43d49",
              "status": "affected",
              "version": "f3ba91228e8e917e5bd6c4b72bfe846933d17370",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/panfrost/panfrost_drv.c",
            "drivers/gpu/drm/panfrost/panfrost_gem.c",
            "drivers/gpu/drm/panfrost/panfrost_gem.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.2"
            },
            {
              "lessThan": "5.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.87",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.87",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.19",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.5",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/panfrost: Fix GEM handle creation ref-counting\n\npanfrost_gem_create_with_handle() previously returned a BO but with the\nonly reference being from the handle, which user space could in theory\nguess and release, causing a use-after-free. Additionally if the call to\npanfrost_gem_mapping_get() in panfrost_ioctl_create_bo() failed then\na(nother) reference on the BO was dropped.\n\nThe _create_with_handle() is a problematic pattern, so ditch it and\ninstead create the handle in panfrost_ioctl_create_bo(). If the call to\npanfrost_gem_mapping_get() fails then this means that user space has\nindeed gone behind our back and freed the handle. In which case just\nreturn an error code."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only via local DRM ioctls on the Panfrost render node (/dev/dri/renderD*): DRM_IOCTL_PANFROST_CREATE_BO and concurrent DRM_IOCTL_GEM_CLOSE. It is not reachable from network packet processing or adjacent-network protocols.\nAC:L - The attacker controls both sides of the race by issuing CREATE_BO on one thread while closing the predictable sequential IDR handle from another; GEM handles allocate from 1 upward so the next handle is trivial to guess. No conditions outside the attacker\u2019s influence are required.\nPR:L - CREATE_BO is marked DRM_RENDER_ALLOW and needs only an open render-node FD, which unprivileged users routinely have on Mali devices (Android phones, ARM SBCs). No CAP_SYS_ADMIN or init-namespace root is required.\nUI:N - The attacker triggers the UAF entirely with their own ioctls; no other user action such as mounting a filesystem or opening a malicious file is needed.\nS:U - This is a kernel heap use-after-free enabling privilege escalation within the same OS security authority. It does not cross a VM, IOMMU isolation, or other Changed-scope boundary.\nC:H - The dangling panfrost_gem_object pointer after GEM_CLOSE is a classic use-after-free; reclaiming the freed object via heap spray can yield arbitrary kernel memory reads.\nI:H - The same UAF/refcount corruption allows reallocation of the freed GEM object and adjacent structures, enabling arbitrary kernel writes and control-flow hijacking.\nA:H - Use of the freed BO (e.g., locking bo-\u003emappings.lock in panfrost_gem_mapping_get) or the erroneous extra drm_gem_object_put causes kernel oops/panic, so availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:58:42.522Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2"
        },
        {
          "url": "https://git.kernel.org/stable/c/ba3d2c2380e7129b525a787489c0b7e819a3b898"
        },
        {
          "url": "https://git.kernel.org/stable/c/4217c6ac817451d5116687f3cc6286220dc43d49"
        }
      ],
      "title": "drm/panfrost: Fix GEM handle creation ref-counting",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50417",
    "datePublished": "2025-09-18T16:04:00.512Z",
    "dateReserved": "2025-09-17T14:53:07.003Z",
    "dateUpdated": "2026-08-05T08:58:42.522Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-50417\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-14T19:10:45.262200Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-14T19:10:40.031Z\"}}], \"cna\": {\"title\": \"drm/panfrost: Fix GEM handle creation ref-counting\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f3ba91228e8e917e5bd6c4b72bfe846933d17370\", \"lessThan\": \"0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3ba91228e8e917e5bd6c4b72bfe846933d17370\", \"lessThan\": \"4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3ba91228e8e917e5bd6c4b72bfe846933d17370\", \"lessThan\": \"3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3ba91228e8e917e5bd6c4b72bfe846933d17370\", \"lessThan\": \"ba3d2c2380e7129b525a787489c0b7e819a3b898\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f3ba91228e8e917e5bd6c4b72bfe846933d17370\", \"lessThan\": \"4217c6ac817451d5116687f3cc6286220dc43d49\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/gpu/drm/panfrost/panfrost_drv.c\", \"drivers/gpu/drm/panfrost/panfrost_gem.c\", \"drivers/gpu/drm/panfrost/panfrost_gem.h\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.2\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.2\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.163\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.87\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0.19\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.0.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.5\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/gpu/drm/panfrost/panfrost_drv.c\", \"drivers/gpu/drm/panfrost/panfrost_gem.c\", \"drivers/gpu/drm/panfrost/panfrost_gem.h\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/0b70f6ea4d4f2b4d4b291d86ab76b4d07394932c\"}, {\"url\": \"https://git.kernel.org/stable/c/4f1105ee72d8c7c35d90e3491b31b2d9d6b7e33a\"}, {\"url\": \"https://git.kernel.org/stable/c/3f9feffa8a5ab08b4e298a27b1aa7204a7d42ca2\"}, {\"url\": \"https://git.kernel.org/stable/c/ba3d2c2380e7129b525a787489c0b7e819a3b898\"}, {\"url\": \"https://git.kernel.org/stable/c/4217c6ac817451d5116687f3cc6286220dc43d49\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/panfrost: Fix GEM handle creation ref-counting\\n\\npanfrost_gem_create_with_handle() previously returned a BO but with the\\nonly reference being from the handle, which user space could in theory\\nguess and release, causing a use-after-free. Additionally if the call to\\npanfrost_gem_mapping_get() in panfrost_ioctl_create_bo() failed then\\na(nother) reference on the BO was dropped.\\n\\nThe _create_with_handle() is a problematic pattern, so ditch it and\\ninstead create the handle in panfrost_ioctl_create_bo(). If the call to\\npanfrost_gem_mapping_get() fails then this means that user space has\\nindeed gone behind our back and freed the handle. In which case just\\nreturn an error code.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.163\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.87\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0.19\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.5\", \"versionStartIncluding\": \"5.2\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2\", \"versionStartIncluding\": \"5.2\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-05-11T19:19:05.512Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-50417\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-11T19:19:05.512Z\", \"dateReserved\": \"2025-09-17T14:53:07.003Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-09-18T16:04:00.512Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.