CVE-2022-50526
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: fix memory corruption with too many bridges Add the missing sanity check on the bridge counter to avoid corrupting data beyond the fixed-sized bridge array in case there are ever more than eight bridges. Patchwork: https://patchwork.freedesktop.org/patch/502664/
Analysis
A memory corruption vulnerability exists in the Linux kernel's MSM display port driver that occurs when more than eight display bridges are connected, allowing local attackers with low privileges to corrupt kernel memory beyond a fixed-size array. The vulnerability affects Linux kernel versions up to 6.1-rc2 and requires local access to exploit, with no known active exploitation in the wild (not in KEV) and a very low EPSS score of 0.02% indicating minimal real-world exploitation likelihood.
Technical Context
The vulnerability resides in the Qualcomm MSM (Mobile Station Modem) display port driver within the Linux kernel's Direct Rendering Manager (DRM) subsystem. Based on the CPE data, this affects the Linux kernel versions through 6.1-rc2 (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* and specific release candidates). The issue is classified as CWE-787 (Out-of-bounds Write), which occurs when software writes data past the end of the intended buffer. In this case, the driver fails to validate the number of display bridges before writing to a fixed-size array, potentially corrupting adjacent kernel memory structures when more than eight bridges are present in the system.
Affected Products
The vulnerability affects the Linux kernel versions up to and including 6.1-rc2, specifically impacting systems using the Qualcomm MSM display port driver. According to the CPE data, this includes all Linux kernel versions prior to the fix (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*) and specifically the 6.1 release candidates rc1 and rc2. The issue is isolated to systems with MSM/Qualcomm display hardware that could theoretically connect more than eight display bridges. Patches are available through the official kernel.org git repositories as referenced in the advisory.
Remediation
Apply the available kernel patches from the vendor by updating to a Linux kernel version that includes commits 74466e46e7543c7f74f1502181e9ba93f7521374 or b312fcab461bd9484c61409007a6fe059f9c2074, available at https://git.kernel.org/stable/. For systems running affected kernels, upgrade to Linux kernel 6.1-rc3 or later stable releases that include this fix. As a temporary mitigation on systems that cannot be immediately patched, limit the number of connected display bridges to eight or fewer, though this is likely already the case for most deployments. Monitor kernel security advisories for your distribution as they will typically backport this fix to their supported kernel versions.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today