Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-50174— net: hinic: avoid kernel hung in hinic_get_stats64()

AI Predicted 5.5 Difficulty: Moderate EPSS 0.16% · P6

Possible ATT&CK Techniques 1AI

T1499 · Endpoint Denial of Service

Affected Version Matrix 12

VendorProductVersion RangeStatus
LinuxLinuxedd384f682cc2981420628b769a1929db680f02f< e74f3097a9c713ce855cda07713393bcc23a005daffected
edd384f682cc2981420628b769a1929db680f02f< 693f31dc91568e61047fd2980a8235e856cd9ce8affected
edd384f682cc2981420628b769a1929db680f02f< fced5bce712122654ec8a20356342698cce104d2affected
edd384f682cc2981420628b769a1929db680f02f< 3ba59bbe4f306bb6ee15753db0a40564c0eb7909affected
edd384f682cc2981420628b769a1929db680f02f< 98f9fcdee35add80505b6c73f72de5f750d5c03caffected
4.14affected
< 4.14unaffected
5.10.137≤ 5.10.*unaffected
… +4 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2022-50174

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: hinic: avoid kernel hung in hinic_get_stats64()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: hinic: avoid kernel hung in hinic_get_stats64() When using hinic device as a bond slave device, and reading device stats of master bond device, the kernel may hung. The kernel panic calltrace as follows: Kernel panic - not syncing: softlockup: hung tasks Call trace: native_queued_spin_lock_slowpath+0x1ec/0x31c dev_get_stats+0x60/0xcc dev_seq_printf_stats+0x40/0x120 dev_seq_show+0x1c/0x40 seq_read_iter+0x3c8/0x4dc seq_read+0xe0/0x130 proc_reg_read+0xa8/0xe0 vfs_read+0xb0/0x1d4 ksys_read+0x70/0xfc __arm64_sys_read+0x20/0x30 el0_svc_common+0x88/0x234 do_el0_svc+0x2c/0x90 el0_svc+0x1c/0x30 el0_sync_handler+0xa8/0xb0 el0_sync+0x148/0x180 And the calltrace of task that actually caused kernel hungs as follows: __switch_to+124 __schedule+548 schedule+72 schedule_timeout+348 __down_common+188 __down+24 down+104 hinic_get_stats64+44 [hinic] dev_get_stats+92 bond_get_stats+172 [bonding] dev_get_stats+92 dev_seq_printf_stats+60 dev_seq_show+24 seq_read_iter+964 seq_read+220 proc_reg_read+164 vfs_read+172 ksys_read+108 __arm64_sys_read+28 el0_svc_common+132 do_el0_svc+40 el0_svc+24 el0_sync_handler+164 el0_sync+324 When getting device stats from bond, kernel will call bond_get_stats(). It first holds the spinlock bond->stats_lock, and then call hinic_get_stats64() to collect hinic device's stats. However, hinic_get_stats64() calls `down(&nic_dev->mgmt_lock)` to protect its critical section, which may schedule current task out. And if system is under high pressure, the task cannot be woken up immediately, which eventually triggers kernel hung panic. Since previous patch has replaced hinic_dev.tx_stats/rx_stats with local variable in hinic_get_stats64(), there is nothing need to be protected by lock, so just removing down()/up() is ok.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于hinic_get_stats64函数中内核挂起问题。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux edd384f682cc2981420628b769a1929db680f02f ~ e74f3097a9c713ce855cda07713393bcc23a005d -
LinuxLinux 4.14 -

II. Public POCs for CVE-2022-50174

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-50174

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-06-18 · 362 CVEs total

CVE-2025-380759.8 CRITICALscsi: target: iscsi: Fix timeout on deleted connection
CVE-2022-500988.8 HIGHscsi: qla2xxx: Fix crash due to stale SRB access around I/O timeouts
CVE-2025-380528.8 HIGHnet/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
CVE-2022-499348.8 HIGHwifi: mac80211: Fix UAF in ieee80211_scan_rx()
CVE-2022-501648.8 HIGHwifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue
CVE-2025-380168.8 HIGHHID: bpf: abort dispatch if device destroyed
CVE-2025-380748.8 HIGHvhost-scsi: protect vq->log_used with vq->mutex
CVE-2022-499748.8 HIGHHID: nintendo: fix rumble worker null pointer deref
CVE-2022-499688.0 HIGHieee802154/adf7242: defer destroy_workqueue call
CVE-2022-499447.8 HIGHRevert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()"
CVE-2022-499507.8 HIGHmisc: fastrpc: fix memory corruption on open
CVE-2022-499397.8 HIGHbinder: fix UAF of ref->proc caused by race condition
CVE-2022-500287.8 HIGHgadgetfs: ep_io - wait until IRQ finishes
CVE-2022-499357.8 HIGHdma-buf/dma-resv: check if the new fence is really later
CVE-2025-380827.8 HIGHgpio: virtuser: fix potential out-of-bound write
CVE-2022-501827.8 HIGHmedia: imx-jpeg: Align upwards buffer size
CVE-2025-380807.8 HIGHdrm/amd/display: Increase block_sequence array size
CVE-2025-380607.8 HIGHbpf: copy_verifier_state() should copy 'loop_entry' field
CVE-2022-501017.8 HIGHvideo: fbdev: vt8623fb: Check the size of screen before memset_io()
CVE-2025-380627.8 HIGHgenirq/msi: Store the IOMMU IOVA directly in msi_desc instead of iommu_cookie

Showing top 20 of 362 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-50174

No comments yet

Leave a comment