CVE-2022-50814

Vulnerability

Analysis

CVE-2022-50814 is a bug in the Linux kernel's crypto subsystem, specifically in the hisi_zip driver for HiSilicon accelerators. The root cause is a type mismatch: the variable sgl_sge_nr is declared as u16 (unsigned 16-bit integer), but the driver used param_get_int and param_set_int functions to get and set its value. These functions operate on int (32-bit), leading to a global out-of-bounds read when the parameter is accessed, as reported by KASAN [1].

Exploitation

An attacker with local access and the ability to read the sgl_sge_nr parameter (e.g., via sysfs) could trigger the out-of-bounds read. No authentication beyond local user access is required. The bug manifests as a KASAN report showing a read of size 4 at an address within the sgl_sge_nr variable's region, indicating a memory corruption or information disclosure [1].

Impact

A successful exploit could lead to a kernel crash (denial of service) or potentially leak sensitive kernel memory. The out-of-bounds read occurs in param_get_int, which is used to retrieve the parameter value, so an attacker could read adjacent memory [1].

Mitigation

The fix replaces param_get_int/param_set_int with param_get_ushort/param_set_ushort, matching the u16 type. The patch has been applied to the stable kernel tree [1][2]. Users should update to a kernel version containing the fix.