Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2022-50307

s390/cio: fix out-of-bounds access on cio_ignore free

High7.1EPSS 0.16%
Published
Updated
Reserved
Assigned by
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: s390/cio: fix out-of-bounds access on cio_ignore free The channel-subsystem-driver scans for newly available devices whenever device-IDs are removed from the cio_ignore list using a command such as: echo free >/proc/cio_ignore Since an I/O device scan might interfer with running I/Os, commit 172da89ed0ea ("s390/cio: avoid excessive path-verification requests") introduced an optimization to exclude online devices from the scan. The newly added check for online devices incorrectly assumes that an I/O-subchannel's drvdata points to a struct io_subchannel_private. For devices that are bound to a non-default I/O subchannel driver, such as the vfio_ccw driver, this results in an out-of-bounds read access during each scan. Fix this by changing the scan logic to rely on a driver-independent online indication. For this we can use struct subchannel->config.ena, which is the driver's requested subchannel-enabled state. Since I/Os can only be started on enabled subchannels, this matches the intent of the original optimization of not scanning devices where I/O might be running.

Scores

CVSS scores of CVE-2022-50307, by who scored it
Scored byCVSSScoreVector
NVDNVD · Analyzed3.1High7.1CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
EPSS (exploitation in 30 days)
0.16% · top 95% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.1.

Weakness

Affected products

  • Linux · Linux

    • affected 172da89ed0eaf9d9348f5decb86ad04c624b39d1 – < 0e501fd0f38e42304bfa0d46a812d93f80294a87
    • affected 172da89ed0eaf9d9348f5decb86ad04c624b39d1 – < 106ab66cf5467726ca5ead51623043d37c06820a
    • affected 172da89ed0eaf9d9348f5decb86ad04c624b39d1 – < 1b6074112742f65ece71b0f299ca5a6a887d2db6

  • Linux · Linux

    • affected 5.15
    • unaffected < 5.15
    • unaffected 5.15.78 – ≤ 5.15.*
    • unaffected 6.0.7 – ≤ 6.0.*
    • unaffected 6.1 – ≤ *

References (3)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2022-50307 badge
[![CVE-2022-50307](https://trackcve.app/badge/CVE-2022-50307.svg)](https://trackcve.app/cve/CVE-2022-50307)

Record last updated .