Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2022-50531— tipc: fix an information leak in tipc_topsrv_kern_subscr

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未完全初始化sub.usr_handle，可能导致信息泄露。

AI Predicted 5.5 Difficulty: Easy EPSS 0.16% · P4

Possible ATT&CK Techniques 1 AI

T1083 · File and Directory Discovery

Affected Version Matrix 14

VendorProduct Version RangeStatus
Linux Linux 026321c6d056a54b4145522492245d2b5913ee1d< 3d1b83ff7b6575a4e41283203e6b2e25ea700cd7 affected
026321c6d056a54b4145522492245d2b5913ee1d< 567f8de358b61015dcfb8878a1f06c5369a45f54 affected
026321c6d056a54b4145522492245d2b5913ee1d< e558e148938442dd49628cd7ef61c360832bef31 affected
026321c6d056a54b4145522492245d2b5913ee1d< dbc01c0a4e202a7e925dad1d4b7c1d6eb0c81154 affected
026321c6d056a54b4145522492245d2b5913ee1d< fef70f978bc289642501d88d2a3f5e841bd31a67 affected
026321c6d056a54b4145522492245d2b5913ee1d< 777ecaabd614d47c482a5c9031579e66da13989a affected
4.17 affected
< 4.17 unaffected
… +6 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-50531

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
tipc: fix an information leak in tipc_topsrv_kern_subscr
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: tipc: fix an information leak in tipc_topsrv_kern_subscr Use a 8-byte write to initialize sub.usr_handle in tipc_topsrv_kern_subscr(), otherwise four bytes remain uninitialized when issuing setsockopt(..., SOL_TIPC, ...). This resulted in an infoleak reported by KMSAN when the packet was received: ===================================================== BUG: KMSAN: kernel-infoleak in copyout+0xbc/0x100 lib/iov_iter.c:169 instrument_copy_to_user ./include/linux/instrumented.h:121 copyout+0xbc/0x100 lib/iov_iter.c:169 _copy_to_iter+0x5c0/0x20a0 lib/iov_iter.c:527 copy_to_iter ./include/linux/uio.h:176 simple_copy_to_iter+0x64/0xa0 net/core/datagram.c:513 __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:419 skb_copy_datagram_iter+0x58/0x200 net/core/datagram.c:527 skb_copy_datagram_msg ./include/linux/skbuff.h:3903 packet_recvmsg+0x521/0x1e70 net/packet/af_packet.c:3469 ____sys_recvmsg+0x2c4/0x810 net/socket.c:? ___sys_recvmsg+0x217/0x840 net/socket.c:2743 __sys_recvmsg net/socket.c:2773 __do_sys_recvmsg net/socket.c:2783 __se_sys_recvmsg net/socket.c:2780 __x64_sys_recvmsg+0x364/0x540 net/socket.c:2780 do_syscall_x64 arch/x86/entry/common.c:50 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd arch/x86/entry/entry_64.S:120 ... Uninit was stored to memory at: tipc_sub_subscribe+0x42d/0xb50 net/tipc/subscr.c:156 tipc_conn_rcv_sub+0x246/0x620 net/tipc/topsrv.c:375 tipc_topsrv_kern_subscr+0x2e8/0x400 net/tipc/topsrv.c:579 tipc_group_create+0x4e7/0x7d0 net/tipc/group.c:190 tipc_sk_join+0x2a8/0x770 net/tipc/socket.c:3084 tipc_setsockopt+0xae5/0xe40 net/tipc/socket.c:3201 __sys_setsockopt+0x87f/0xdc0 net/socket.c:2252 __do_sys_setsockopt net/socket.c:2263 __se_sys_setsockopt net/socket.c:2260 __x64_sys_setsockopt+0xe0/0x160 net/socket.c:2260 do_syscall_x64 arch/x86/entry/common.c:50 do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd arch/x86/entry/entry_64.S:120 Local variable sub created at: tipc_topsrv_kern_subscr+0x57/0x400 net/tipc/topsrv.c:562 tipc_group_create+0x4e7/0x7d0 net/tipc/group.c:190 Bytes 84-87 of 88 are uninitialized Memory access of size 88 starts at ffff88801ed57cd0 Data copied to user address 0000000020000400 ... =====================================================
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于未完全初始化sub.usr_handle，可能导致信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 026321c6d056a54b4145522492245d2b5913ee1d ~ 3d1b83ff7b6575a4e41283203e6b2e25ea700cd7 -
Linux Linux 4.17 -

II. Public POCs for CVE-2022-50531

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-50531

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-50531 (6)

Same Patch Batch · Linux · 2025-10-07 · 118 CVEs total

CVE-2023-53629 9.8 CRITICAL fs: dlm: fix use after free in midcomms commit
CVE-2023-53630 8.8 HIGH iommufd: Fix unpinning of pages when an access is present
CVE-2023-53676 8.8 HIGH scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show()
CVE-2023-53675 8.8 HIGH scsi: ses: Fix possible desc_ptr out-of-bounds accesses
CVE-2023-53673 8.8 HIGH Bluetooth: hci_event: call disconnect callback before deleting conn
CVE-2023-53679 8.3 HIGH wifi: mt7601u: fix an integer underflow
CVE-2023-53635 8.2 HIGH netfilter: conntrack: fix wrong ct->timeout value
CVE-2023-53669 7.8 HIGH tcp: fix skb_copy_ubufs() vs BIG TCP
CVE-2022-50555 7.8 HIGH tipc: fix a null-ptr-deref in tipc_topsrv_accept
CVE-2023-53627 7.8 HIGH scsi: hisi_sas: Grab sas_dev lock when traversing the members of sas_dev.list
CVE-2023-53626 7.8 HIGH ext4: fix possible double unlock when moving a directory
CVE-2023-53660 7.8 HIGH bpf, cpumap: Handle skb as well when clean up ptr_ring
CVE-2023-53659 7.8 HIGH iavf: Fix out-of-bounds when setting channels on remove
CVE-2023-53643 7.8 HIGH nvme-tcp: don't access released socket during error recovery
CVE-2023-53619 7.8 HIGH netfilter: conntrack: Avoid nf_ct_helper_hash uses after free
CVE-2023-53645 7.8 HIGH bpf: Make bpf_refcount_acquire fallible for non-owning refs
CVE-2023-53646 7.8 HIGH drm/i915/perf: add sentinel to xehp_oa_b_counters
CVE-2022-50528 7.8 HIGH drm/amdkfd: Fix memory leakage
CVE-2023-53651 7.8 HIGH Input: exc3000 - properly stop timer on shutdown
CVE-2022-50543 7.8 HIGH RDMA/rxe: Fix mr->map double free

Showing top 20 of 118 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-50531

No comments yet

Leave a comment