#VU111623 Integer overflow in Linux kernel - CVE-2022-50167
Published: June 20, 2025 / Updated: June 21, 2025
Vulnerability identifier: #VU111623
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2022-50167
CWE-ID: CWE-190
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
Linux kernel
Linux kernel
Software vendor:
Linux Foundation
Linux Foundation
Description
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to integer overflow within the array_map_alloc(), array_map_lookup_elem(), array_map_update_elem(), array_map_free_timers(), array_map_free(), bpf_array_map_seq_start(), bpf_array_map_seq_next() and bpf_for_each_array_elem() functions in kernel/bpf/arraymap.c. A local user can execute arbitrary code.
Remediation
Install update from vendor's repository.
External links
- https://git.kernel.org/stable/c/063e092534d4c6785228e5b1eb6e9329f66ccbe4
- https://git.kernel.org/stable/c/3c7256b880b3a5aa1895fd169a34aa4224a11862
- https://git.kernel.org/stable/c/87ac0d600943994444e24382a87aa19acc4cd3d4
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.18
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.2
- https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0