CVE-2022-50167 (GCVE-0-2022-50167)
Vulnerability from cvelistv5 – Published: 2025-06-18 11:03 – Updated: 2026-08-05 08:57
VLAI
EPSS
VEX
Title
bpf: fix potential 32-bit overflow when accessing ARRAY map element
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: fix potential 32-bit overflow when accessing ARRAY map element
If BPF array map is bigger than 4GB, element pointer calculation can
overflow because both index and elem_size are u32. Fix this everywhere
by forcing 64-bit multiplication. Extract this formula into separate
small helper and use it consistently in various places.
Speculative-preventing formula utilizing index_mask trick is left as is,
but explicit u64 casts are added in both places.
Severity
7.8 (High)
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Linux | Linux |
Affected:
c85d69135a9175c50a823d04d62d932312d037b3 , < 063e092534d4c6785228e5b1eb6e9329f66ccbe4
(git)
Affected: c85d69135a9175c50a823d04d62d932312d037b3 , < 3c7256b880b3a5aa1895fd169a34aa4224a11862 (git) Affected: c85d69135a9175c50a823d04d62d932312d037b3 , < 87ac0d600943994444e24382a87aa19acc4cd3d4 (git) |
|
| Linux | Linux |
Affected:
5.3
Unaffected: 0 , < 5.3 (semver) Unaffected: 5.18.18 , ≤ 5.18.* (semver) Unaffected: 5.19.2 , ≤ 5.19.* (semver) Unaffected: 6.0 , ≤ * (original_commit_for_fix) |
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/arraymap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "063e092534d4c6785228e5b1eb6e9329f66ccbe4",
"status": "affected",
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
"versionType": "git"
},
{
"lessThan": "3c7256b880b3a5aa1895fd169a34aa4224a11862",
"status": "affected",
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
"versionType": "git"
},
{
"lessThan": "87ac0d600943994444e24382a87aa19acc4cd3d4",
"status": "affected",
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/arraymap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.18.*",
"status": "unaffected",
"version": "5.18.18",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.19.*",
"status": "unaffected",
"version": "5.19.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.18.18",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19.2",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0",
"versionStartIncluding": "5.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix potential 32-bit overflow when accessing ARRAY map element\n\nIf BPF array map is bigger than 4GB, element pointer calculation can\noverflow because both index and elem_size are u32. Fix this everywhere\nby forcing 64-bit multiplication. Extract this formula into separate\nsmall helper and use it consistently in various places.\n\nSpeculative-preventing formula utilizing index_mask trick is left as is,\nbut explicit u64 casts are added in both places."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The bug is in BPF ARRAY map element pointer math in kernel/bpf/arraymap.c, reached only via the local bpf(2) syscall (map create/lookup/update and map FD release), not via network packet processing.\nAC:L - An attacker who can create a \u003e4GB ARRAY map fully controls map size, indices, timer arming, and FD close, so the 32-bit overflow and resulting bad pointer/timer mishandling are reliably triggerable with no conditions outside their control.\nPR:L - BPF ARRAY map create/use is available to an unprivileged local user when unprivileged BPF is enabled, and the higher-impact timer path needs only CAP_BPF (not full root); when uncertain, the lower privilege requirement is scored.\nUI:N - Exploitation requires only attacker-controlled bpf(2) operations and closing their own map FD; no victim user action is needed.\nS:U - Impact stays within the host kernel\u2019s authority (local memory corruption / privilege escalation); there is no VM, IOMMU, or other security-authority boundary crossed.\nC:H - On map uref drop, array_map_free_timers skips high-index timers due to the overflow, leaving live hrtimers into map memory that is later freed\u2014a use-after-free that can be leveraged for arbitrary kernel read.\nI:H - The same timer use-after-free (and wrong-element update/free of kernel-managed map fields) yields a corruptible kernel object and is exploitable for arbitrary write / control-flow hijacking.\nA:H - A use-after-free in a softirq hrtimer callback can oops/panic the kernel, and guidance treats any UAF as high availability impact even when not fully exploited."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T08:57:36.387Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/063e092534d4c6785228e5b1eb6e9329f66ccbe4"
},
{
"url": "https://git.kernel.org/stable/c/3c7256b880b3a5aa1895fd169a34aa4224a11862"
},
{
"url": "https://git.kernel.org/stable/c/87ac0d600943994444e24382a87aa19acc4cd3d4"
}
],
"title": "bpf: fix potential 32-bit overflow when accessing ARRAY map element",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50167",
"datePublished": "2025-06-18T11:03:20.997Z",
"dateReserved": "2025-06-18T10:57:27.426Z",
"dateUpdated": "2026-08-05T08:57:36.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2022-50167",
"date": "2026-10-11",
"epss": "0.00257",
"percentile": "0.1599"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/arraymap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "063e092534d4c6785228e5b1eb6e9329f66ccbe4",
"status": "affected",
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
"versionType": "git"
},
{
"lessThan": "3c7256b880b3a5aa1895fd169a34aa4224a11862",
"status": "affected",
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
"versionType": "git"
},
{
"lessThan": "87ac0d600943994444e24382a87aa19acc4cd3d4",
"status": "affected",
"version": "c85d69135a9175c50a823d04d62d932312d037b3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/arraymap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.3"
},
{
"lessThan": "5.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.18.*",
"status": "unaffected",
"version": "5.18.18",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.19.*",
"status": "unaffected",
"version": "5.19.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B02C474E-3473-42B0-8C3A-FE88F36ABE5A",
"versionEndExcluding": "5.18.18",
"versionStartIncluding": "5.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A2A5A5-4598-4D7E-BA07-4660398D6C8F",
"versionEndExcluding": "5.19.2",
"versionStartIncluding": "5.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: fix potential 32-bit overflow when accessing ARRAY map element\n\nIf BPF array map is bigger than 4GB, element pointer calculation can\noverflow because both index and elem_size are u32. Fix this everywhere\nby forcing 64-bit multiplication. Extract this formula into separate\nsmall helper and use it consistently in various places.\n\nSpeculative-preventing formula utilizing index_mask trick is left as is,\nbut explicit u64 casts are added in both places."
},
{
"lang": "es",
"value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bpf: se corrige un posible desbordamiento de 32 bits al acceder al elemento del mapa de matriz. Si el mapa de matriz BPF supera los 4 GB, el c\u00e1lculo del puntero del elemento puede desbordarse, ya que tanto el \u00edndice como el tama\u00f1o de elem son u32. Se corrige este problema en todas partes forzando la multiplicaci\u00f3n de 64 bits. Se extrae esta f\u00f3rmula en un peque\u00f1o ayudante independiente y se usa de forma consistente en varios lugares. La f\u00f3rmula que evita la especulaci\u00f3n mediante el truco de index_mask se mantiene sin cambios, pero se a\u00f1aden conversiones u64 expl\u00edcitas en ambos lugares."
}
],
"id": "CVE-2022-50167",
"lastModified": "2026-08-04T10:18:06.443",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2025-06-18T11:15:47.010",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/063e092534d4c6785228e5b1eb6e9329f66ccbe4"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/3c7256b880b3a5aa1895fd169a34aa4224a11862"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/87ac0d600943994444e24382a87aa19acc4cd3d4"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-190"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-04T19:40:42+00:00",
"cve": "CVE-2022-50167",
"id": "CVE-2022-50167",
"initial_release_date": "2022-01-01T00:00:00+00:00",
"product_status:known_affected": "156",
"product_status:known_not_affected": "118",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: bpf: fix potential 32-bit overflow when accessing ARRAY map element",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50167.json",
"version": "3"
}
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…