GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50623 (GCVE-0-2022-50623)

Vulnerability from cvelistv5 – Published: 2025-12-08 01:16 – Updated: 2026-08-05 08:59
VLAI
Title
fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()
Summary
In the Linux kernel, the following vulnerability has been resolved: fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() The "hdr.count * sizeof(s32)" multiplication can overflow on 32 bit systems leading to memory corruption. Use array_size() to fix that.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 322b598be4d9b9090cda560c4caab78704615ab4 , < f59861946fa51bcc1f305809e4ebc1013b0ee61c (git)
Affected: 322b598be4d9b9090cda560c4caab78704615ab4 , < b94605f5cb99e90c8ca91523597a40e1bd59546b (git)
Affected: 322b598be4d9b9090cda560c4caab78704615ab4 , < 1b5a931594f7ffd26d706614c37d4da0f2ffb6e7 (git)
Affected: 322b598be4d9b9090cda560c4caab78704615ab4 , < 940253af8b3865b76de8d1b46bcd4a700104852e (git)
Affected: 322b598be4d9b9090cda560c4caab78704615ab4 , < 939bc5453b8cbdde9f1e5110ce8309aedb1b501a (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 5.10.150 , ≤ 5.10.* (semver)
Unaffected: 5.15.75 , ≤ 5.15.* (semver)
Unaffected: 5.19.17 , ≤ 5.19.* (semver)
Unaffected: 6.0.3 , ≤ 6.0.* (semver)
Unaffected: 6.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/fpga/dfl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f59861946fa51bcc1f305809e4ebc1013b0ee61c",
              "status": "affected",
              "version": "322b598be4d9b9090cda560c4caab78704615ab4",
              "versionType": "git"
            },
            {
              "lessThan": "b94605f5cb99e90c8ca91523597a40e1bd59546b",
              "status": "affected",
              "version": "322b598be4d9b9090cda560c4caab78704615ab4",
              "versionType": "git"
            },
            {
              "lessThan": "1b5a931594f7ffd26d706614c37d4da0f2ffb6e7",
              "status": "affected",
              "version": "322b598be4d9b9090cda560c4caab78704615ab4",
              "versionType": "git"
            },
            {
              "lessThan": "940253af8b3865b76de8d1b46bcd4a700104852e",
              "status": "affected",
              "version": "322b598be4d9b9090cda560c4caab78704615ab4",
              "versionType": "git"
            },
            {
              "lessThan": "939bc5453b8cbdde9f1e5110ce8309aedb1b501a",
              "status": "affected",
              "version": "322b598be4d9b9090cda560c4caab78704615ab4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/fpga/dfl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.150",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.150",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.75",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.17",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.3",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfpga: prevent integer overflow in dfl_feature_ioctl_set_irq()\n\nThe \"hdr.count * sizeof(s32)\" multiplication can overflow on 32 bit\nsystems leading to memory corruption.  Use array_size() to fix that."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached via ioctl on local DFL character devices (/dev/dfl-port.* or /dev/dfl-fme.*) through afu_ioctl/fme_ioctl into dfl_feature_ioctl_set_irq(); it is not reachable from network packet processing or physical bus injection.\nAC:L - An attacker who can open the device fully controls hdr.start/hdr.count and the eventfd array and can issue the SET_IRQ ioctl directly; triggering the overflow path does not depend on a race or other conditions outside the attacker\u2019s influence.\nPR:L - Neither open nor the SET_IRQ ioctl path checks capabilities\u2014only device-node permissions\u2014and DFL ports/AFUs are explicitly intended for userspace applications, including SR-IOV VF tenants and deployments that grant group access via udev, so real root is not required.\nUI:N - The attacker opens the DFL device and issues DFL_FPGA_*_SET_IRQ themselves; no separate victim action such as mounting a filesystem or opening a crafted file is required.\nS:U - Impact is memory corruption within the host (or guest, under VF passthrough) kernel\u2019s DFL driver privilege boundary; this is ordinary local kernel compromise, not a VM escape or IOMMU/cross-authority bypass.\nC:H - The integer overflow causes memdup_user() to allocate an undersized buffer while the code still iterates hdr.count entries, producing an out-of-bounds kernel heap read of the fds array that can be leveraged for information disclosure under memory-corruption guidance.\nI:H - The commit documents memory corruption from the wrapped allocation size; an undersized heap object consumed as a large fd array is exploitable for integrity compromise and control-flow impact consistent with kernel scoring of similar memdup_user overflows.\nA:H - Out-of-bounds access of the undersized fds buffer can oops/panic the kernel (including KASAN or unmapped heap pages), which is high availability impact under kernel CVSS guidance."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:12.762Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f59861946fa51bcc1f305809e4ebc1013b0ee61c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b94605f5cb99e90c8ca91523597a40e1bd59546b"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b5a931594f7ffd26d706614c37d4da0f2ffb6e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/940253af8b3865b76de8d1b46bcd4a700104852e"
        },
        {
          "url": "https://git.kernel.org/stable/c/939bc5453b8cbdde9f1e5110ce8309aedb1b501a"
        }
      ],
      "title": "fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50623",
    "datePublished": "2025-12-08T01:16:37.086Z",
    "dateReserved": "2025-12-08T01:14:55.190Z",
    "dateUpdated": "2026-08-05T08:59:12.762Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50623",
      "date": "2026-09-20",
      "epss": "0.00153",
      "percentile": "0.04813"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/fpga/dfl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f59861946fa51bcc1f305809e4ebc1013b0ee61c",
                    "status": "affected",
                    "version": "322b598be4d9b9090cda560c4caab78704615ab4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b94605f5cb99e90c8ca91523597a40e1bd59546b",
                    "status": "affected",
                    "version": "322b598be4d9b9090cda560c4caab78704615ab4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1b5a931594f7ffd26d706614c37d4da0f2ffb6e7",
                    "status": "affected",
                    "version": "322b598be4d9b9090cda560c4caab78704615ab4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "940253af8b3865b76de8d1b46bcd4a700104852e",
                    "status": "affected",
                    "version": "322b598be4d9b9090cda560c4caab78704615ab4",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "939bc5453b8cbdde9f1e5110ce8309aedb1b501a",
                    "status": "affected",
                    "version": "322b598be4d9b9090cda560c4caab78704615ab4",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/fpga/dfl.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.9"
                  },
                  {
                    "lessThan": "5.9",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.150",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.75",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.17",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfpga: prevent integer overflow in dfl_feature_ioctl_set_irq()\n\nThe \"hdr.count * sizeof(s32)\" multiplication can overflow on 32 bit\nsystems leading to memory corruption.  Use array_size() to fix that."
          }
        ],
        "id": "CVE-2022-50623",
        "lastModified": "2026-08-04T10:18:20.040",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-12-08T02:15:48.250",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1b5a931594f7ffd26d706614c37d4da0f2ffb6e7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/939bc5453b8cbdde9f1e5110ce8309aedb1b501a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/940253af8b3865b76de8d1b46bcd4a700104852e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b94605f5cb99e90c8ca91523597a40e1bd59546b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f59861946fa51bcc1f305809e4ebc1013b0ee61c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:23:22+00:00",
      "cve": "CVE-2022-50623",
      "id": "CVE-2022-50623",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: fpga: prevent integer overflow in dfl_feature_ioctl_set_irq()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50623.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-01T01:24:11Z",
      "cve": "CVE-2022-50623",
      "id": "CVE-2022-50623",
      "initial_release_date": "2025-12-09T00:31:28Z",
      "product_status:known_affected": "354",
      "product_status:known_not_affected": "380",
      "product_status:recommended": "200",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-50623",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-50623.json",
      "version": "26"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.