GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50255 (GCVE-0-2022-50255)

Vulnerability from cvelistv5 – Published: 2025-09-15 14:02 – Updated: 2026-08-05 08:57
VLAI
Title
tracing: Fix reading strings from synthetic events
Summary
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix reading strings from synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]' > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is that the synthetic event field "char file[]" will read the value given to it as a string without any memory checks to make sure the address is valid. The above example will pass in the user space address and the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that can read strings safely (and actually succeed when the address is from user space and the memory is mapped in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bd82631d7ccdc894af2738e47abcba2cb6e7dea9 , < d9c79fbcbdb6cb10c07c85040eaf615180b26c48 (git)
Affected: bd82631d7ccdc894af2738e47abcba2cb6e7dea9 , < 149198d0b884e4606ed1d29b330c70016d878276 (git)
Affected: bd82631d7ccdc894af2738e47abcba2cb6e7dea9 , < f8bae1853196b52ede50950387f5b48cf83b9815 (git)
Affected: bd82631d7ccdc894af2738e47abcba2cb6e7dea9 , < 0934ae9977c27133449b6dd8c6213970e7eece38 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.15.75 , ≤ 5.15.* (semver)
Unaffected: 5.19.17 , ≤ 5.19.* (semver)
Unaffected: 6.0.3 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_synth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d9c79fbcbdb6cb10c07c85040eaf615180b26c48",
              "status": "affected",
              "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9",
              "versionType": "git"
            },
            {
              "lessThan": "149198d0b884e4606ed1d29b330c70016d878276",
              "status": "affected",
              "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9",
              "versionType": "git"
            },
            {
              "lessThan": "f8bae1853196b52ede50950387f5b48cf83b9815",
              "status": "affected",
              "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9",
              "versionType": "git"
            },
            {
              "lessThan": "0934ae9977c27133449b6dd8c6213970e7eece38",
              "status": "affected",
              "version": "bd82631d7ccdc894af2738e47abcba2cb6e7dea9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/trace/trace_events_synth.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix reading strings from synthetic events\n\nThe follow commands caused a crash:\n\n  # cd /sys/kernel/tracing\n  # echo \u0027s:open char file[]\u0027 \u003e dynamic_events\n  # echo \u0027hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)\u0027 \u003e events/syscalls/sys_enter_openat/trigger\u0027\n  # echo 1 \u003e events/synthetic/open/enable\n\nBOOM!\n\nThe problem is that the synthetic event field \"char file[]\" will read\nthe value given to it as a string without any memory checks to make sure\nthe address is valid. The above example will pass in the user space\naddress and the sythetic event code will happily call strlen() on it\nand then strscpy() where either one will cause an oops when accessing\nuser space addresses.\n\nUse the helper functions from trace_kprobe and trace_eprobe that can\nread strings safely (and actually succeed when the address is from user\nspace and the memory is mapped in).\n\nNow the above can show:\n\n     packagekitd-1721    [000] ...2.   104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr\n    in:imjournal-978     [006] ...2.   104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp\n     packagekitd-1721    [000] ...2.   104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only by writing synthetic-event and hist-trigger commands to local tracefs (`dynamic_events` / `events/*/trigger`) and then hitting the armed tracepoint via local syscalls; there is no network or adjacent-protocol path into `trace_event_raw_event_synth()` / `trace_string()`.\nAC:L - The upstream reproducer is a deterministic sequence of tracefs writes plus ordinary syscalls (e.g. openat); no race or attacker-uncontrollable layout is required for the oops, and for the ring-buffer over-copy path the attacker fully controls both threads mutating the source string.\nPR:L - There is no capable() gate on this path\u2014access is pure tracefs DAC (0640), routinely delegated to non-root principals (Android/Perfetto, ChromeOS debugd, gid=-mounted tracing groups), matching established PR:L scoring for hist/synthetic tracefs bugs.\nUI:N - The attacker creates the synthetic event, installs the hist trigger, enables it, and fires the traced syscall themselves; no separate victim action is required.\nS:U - Impact stays inside the host kernel tracing/ring-buffer authority; this is not a VM escape, IOMMU bypass, or other cross-boundary compromise.\nC:H - Syscall `const char *` fields are stored as raw pointers and then strlen/strscpy\u0027d into the synthetic event; an attacker can pass kernel addresses as syscall arguments so arbitrary NUL-terminated kernel memory is copied into the readable trace buffer.\nI:H - Event size is computed with one strlen and the copy uses a second strlen/strscpy; a concurrent attacker-controlled mutation of the source string yields an out-of-bounds write past the reserved ring-buffer entry, a heap corruption primitive.\nA:H - strlen/strscpy on an unmapped or SMAP-protected address causes a reliable kernel oops/panic (the documented BOOM!), fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:57:58.020Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d9c79fbcbdb6cb10c07c85040eaf615180b26c48"
        },
        {
          "url": "https://git.kernel.org/stable/c/149198d0b884e4606ed1d29b330c70016d878276"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8bae1853196b52ede50950387f5b48cf83b9815"
        },
        {
          "url": "https://git.kernel.org/stable/c/0934ae9977c27133449b6dd8c6213970e7eece38"
        }
      ],
      "title": "tracing: Fix reading strings from synthetic events",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50255",
    "datePublished": "2025-09-15T14:02:37.224Z",
    "dateReserved": "2025-09-15T13:58:00.973Z",
    "dateUpdated": "2026-08-05T08:57:58.020Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50255",
      "date": "2026-09-17",
      "epss": "0.00164",
      "percentile": "0.06002"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-50255\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-09-15T14:15:36.247\",\"lastModified\":\"2026-08-04T10:18:09.263\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntracing: Fix reading strings from synthetic events\\n\\nThe follow commands caused a crash:\\n\\n  # cd /sys/kernel/tracing\\n  # echo \u0027s:open char file[]\u0027 \u003e dynamic_events\\n  # echo \u0027hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)\u0027 \u003e events/syscalls/sys_enter_openat/trigger\u0027\\n  # echo 1 \u003e events/synthetic/open/enable\\n\\nBOOM!\\n\\nThe problem is that the synthetic event field \\\"char file[]\\\" will read\\nthe value given to it as a string without any memory checks to make sure\\nthe address is valid. The above example will pass in the user space\\naddress and the sythetic event code will happily call strlen() on it\\nand then strscpy() where either one will cause an oops when accessing\\nuser space addresses.\\n\\nUse the helper functions from trace_kprobe and trace_eprobe that can\\nread strings safely (and actually succeed when the address is from user\\nspace and the memory is mapped in).\\n\\nNow the above can show:\\n\\n     packagekitd-1721    [000] ...2.   104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr\\n    in:imjournal-978     [006] ...2.   104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp\\n     packagekitd-1721    [000] ...2.   104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/trace/trace_events_synth.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"bd82631d7ccdc894af2738e47abcba2cb6e7dea9\",\"lessThan\":\"d9c79fbcbdb6cb10c07c85040eaf615180b26c48\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bd82631d7ccdc894af2738e47abcba2cb6e7dea9\",\"lessThan\":\"149198d0b884e4606ed1d29b330c70016d878276\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bd82631d7ccdc894af2738e47abcba2cb6e7dea9\",\"lessThan\":\"f8bae1853196b52ede50950387f5b48cf83b9815\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"bd82631d7ccdc894af2738e47abcba2cb6e7dea9\",\"lessThan\":\"0934ae9977c27133449b6dd8c6213970e7eece38\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/trace/trace_events_synth.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.75\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.17\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0.3\",\"lessThanOrEqual\":\"6.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10\",\"versionEndExcluding\":\"5.15.75\",\"matchCriteriaId\":\"31A04601-B8E8-4F81-8415-9142CA0221FA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.19.17\",\"matchCriteriaId\":\"19B4C3A4-E5C3-41DC-BB14-BE72858E7D35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.0\",\"versionEndExcluding\":\"6.0.3\",\"matchCriteriaId\":\"5BCD8201-B847-4442-B894-70D430128DEF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0934ae9977c27133449b6dd8c6213970e7eece38\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/149198d0b884e4606ed1d29b330c70016d878276\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d9c79fbcbdb6cb10c07c85040eaf615180b26c48\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f8bae1853196b52ede50950387f5b48cf83b9815\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:40:40+00:00",
      "cve": "CVE-2022-50255",
      "id": "CVE-2022-50255",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "108",
      "product_status:known_not_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tracing: Fix reading strings from synthetic events",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50255.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:37:32Z",
      "cve": "CVE-2022-50255",
      "id": "CVE-2022-50255",
      "initial_release_date": "2025-09-17T23:31:41Z",
      "product_status:known_affected": "344",
      "product_status:known_not_affected": "395",
      "product_status:recommended": "206",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50255",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50255.json",
      "version": "32"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.