CyberSecBulletin
CVE-2022-50169NVD status: Analyzed

Linux: Missing Initialization of Resource

Published Updated By the CyberSecBulletin desk

CVE-2022-50169 is a high-severity missing initialization of resource vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions c1216e699a1ce83ea005510844bd7508d34c6cef, 4615458db7793fadc6d546ac3564b36819e77a22, 60c9983425167ec5073c628d83a6875760d18059 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.27% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to c1216e699a1ce83ea005510844bd7508d34c6cef or 4615458db7793fadc6d546ac3564b36819e77a22 or 60c9983425167ec5073c628d83a6875760d18059 or 05ceda14ef7c73104e709c414c3680d8a59f51d4, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.14.291 or 4.19.256 or 5.4.211 or 5.10.137, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinuxff974e4083341383d3dd4079e52ed30f57f376f0 up to, but not including, c1216e699a1ce83ea005510844bd7508d34c6cef; ff974e4083341383d3dd4079e52ed30f57f376f0 up to, but not including, 4615458db7793fadc6d546ac3564b36819e77a22; ff974e4083341383d3dd4079e52ed30f57f376f0 up to, but not including, 60c9983425167ec5073c628d83a6875760d18059; ff974e4083341383d3dd4079e52ed30f57f376f0 up to, but not including, 05ceda14ef7c73104e709c414c3680d8a59f51d4; ff974e4083341383d3dd4079e52ed30f57f376f0 up to, but not including, 074e865b37da55aa87baa16d68b96896f85f8adb; ff974e4083341383d3dd4079e52ed30f57f376f0 up to, but not including, 789edc1af9c1a2293956e8534bfef3d18d629de9; ff974e4083341383d3dd4079e52ed30f57f376f0 up to, but not including, 67470920cd3f3cb38699b1ad23234f96bead4d21; ff974e4083341383d3dd4079e52ed30f57f376f0 up to, but not including, 7a4836560a6198d245d5732e26f94898b12eb760; and 1 more rangesc1216e699a1ce83ea005510844bd7508d34c6cef, 4615458db7793fadc6d546ac3564b36819e77a22, 60c9983425167ec5073c628d83a6875760d18059, 05ceda14ef7c73104e709c414c3680d8a59f51d4, 074e865b37da55aa87baa16d68b96896f85f8adb, 789edc1af9c1a2293956e8534bfef3d18d629de9
LinuxLinux Kernel3.17 up to, but not including, 4.14.291; 4.15 up to, but not including, 4.19.256; 4.20 up to, but not including, 5.4.211; 5.5 up to, but not including, 5.10.137; 5.11 up to, but not including, 5.15.61; 5.16 up to, but not including, 5.18.18; 5.19 up to, but not including, 5.19.24.14.291, 4.19.256, 5.4.211, 5.10.137, 5.15.61, 5.18.18

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: wifi: wil6210: debugfs: fix info leak in wil_write_file_wmi() The simple_write_to_buffer() function will succeed if even a single byte is initialized. However, we need to initialize the whole buffer to prevent information leaks. Just use memdup_user().

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Missing Initialization of Resource

The product does not initialize a critical resource.

How developers prevent this class of flaw

  • Explicitly initialize the resource before use. If this is performed through an API function or standard procedure, follow all specified steps.
  • Pay close attention to complex conditionals that affect initialization, since some branches might not perform the initialization.
  • Avoid race conditions (CWE-362) during initialization routines.

More Missing Initialization of Resource vulnerabilities (CWE-909)

Timeline

  1. CVE record published.
  2. Record last changed materially (score, affected products, status or references).

References

Recent Missing Initialization of Resource vulnerabilities

Spotted an error? Tell us.