Vulnerability details
CVE-2022-50330
Linux Linux
crypto: cavium - prevent integer overflow loading firmware
CVSS 3.1
7.1High
Official description
In the Linux kernel, the following vulnerability has been resolved: crypto: cavium - prevent integer overflow loading firmware The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you can do to protect yourself. Still we try to limit the damage as much as possible. Also Smatch marks any data read from the filesystem as untrusted and prints warnings if it not capped correctly. The "ntohl(ucode->code_length) * 2" multiplication can have an integer overflow.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 7.1High | 3.1 | CVEProject cvelistV5 (CNA) (Linux) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| Linux | Linux | 4.11 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 9e2c7d99941d000a36f68a3594cec27a1bbea274 ≤ v < 90e483e7f20c32287d2a9da967e122938f52737a | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 9e2c7d99941d000a36f68a3594cec27a1bbea274 ≤ v < 584561e94260268abe1c83e00d9c205565cb7bc5 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 9e2c7d99941d000a36f68a3594cec27a1bbea274 ≤ v < 3a720eb89026c5241b8c4abb33370dc6fb565eee | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 9e2c7d99941d000a36f68a3594cec27a1bbea274 ≤ v < c4d4c2afd08dfb3cd1c880d1811ede2568e81a6d | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 9e2c7d99941d000a36f68a3594cec27a1bbea274 ≤ v < 371fa5129af53a79f6dddc90fe5bb0825cbe72a4 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 9e2c7d99941d000a36f68a3594cec27a1bbea274 ≤ v < e29fd7a6852376d2cfb95ad5d6d3eeff93f815e9 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 9e2c7d99941d000a36f68a3594cec27a1bbea274 ≤ v < 2526d6bf27d15054bb0778b2f7bc6625fd934905 | CVEProject cvelistV5 (CNA) |
| Linux | Linux | 9e2c7d99941d000a36f68a3594cec27a1bbea274 ≤ v < 172c8a24fc8312cf6b88d3c88469653fdcb1c127 | CVEProject cvelistV5 (CNA) |
References and advisories
8- https://git.kernel.org/stable/c/c4d4c2afd08dfb3cd1c880d1811ede2568e81a6d
- https://git.kernel.org/stable/c/90e483e7f20c32287d2a9da967e122938f52737a
- https://git.kernel.org/stable/c/584561e94260268abe1c83e00d9c205565cb7bc5
- https://git.kernel.org/stable/c/3a720eb89026c5241b8c4abb33370dc6fb565eee
- https://git.kernel.org/stable/c/172c8a24fc8312cf6b88d3c88469653fdcb1c127
- https://git.kernel.org/stable/c/371fa5129af53a79f6dddc90fe5bb0825cbe72a4
- https://git.kernel.org/stable/c/e29fd7a6852376d2cfb95ad5d6d3eeff93f815e9
- https://git.kernel.org/stable/c/2526d6bf27d15054bb0778b2f7bc6625fd934905
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2025-09-15
- Last updated
- 2026-08-05
- State
- Published
- Assigner (CNA)
- Linux
Exploit prediction (EPSS)
0.16%
Probability of exploitation in 30 days
5.6%
Percentile (among all CVEs)
Weaknesses (CWE)
- —