CVE-2022-50630
- Source
- https://cve.org/CVERecord?id=CVE-2022-50630
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50630.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-50630
- Downstream
- Related
- Published
- 2025-12-08T01:16:45Z
- Modified
- 2026-08-12T03:51:27Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- mm: hugetlb: fix UAF in hugetlb_handle_userfault
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
mm: hugetlb: fix UAF in hugetlb_handle_userfault
The vma_lock and hugetlb_fault_mutex are dropped before handling userfault and reacquire them again after handle_userfault(), but reacquire the vma_lock could lead to UAF[1,2] due to the following race,
hugetlb_fault hugetlb_no_page /unlock vma_lock / hugetlb_handle_userfault handle_userfault / unlock mm->mmap_lock/ vm_mmap_pgoff do_mmap mmap_region munmap_vma_range /* clean old vma / / lock vma_lock again <--- UAF / / unlock vma_lock */
Since the vma_lock will unlock immediately after hugetlb_handle_userfault(), let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to fix the issue.
[1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@google.com/ [2] https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@huawei.com/
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50630.json" }- References
-
- https://git.kernel.org/stable/c/0db2efb3bff879566f05341d94c3de00ac95c4cc
- https://git.kernel.org/stable/c/45c33966759ea1b4040c08dacda99ef623c0ca29
- https://git.kernel.org/stable/c/78504bcedb2f1bbfb353b4d233c24d641c4dda33
- https://git.kernel.org/stable/c/958f32ce832ba781ac20e11bb2d12a9352ea28fc
- https://git.kernel.org/stable/c/dd691973f67b2800a97db723b1ff6f07fdcf7f5a
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50630.json
- https://nvd.nist.gov/vuln/detail/CVE-2022-50630
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced1a1aad8a9b7bd34f60cdf98cd7915f00ae892c45Fixed45c33966759ea1b4040c08dacda99ef623c0ca29Fixed0db2efb3bff879566f05341d94c3de00ac95c4ccFixeddd691973f67b2800a97db723b1ff6f07fdcf7f5aFixed78504bcedb2f1bbfb353b4d233c24d641c4dda33Fixed958f32ce832ba781ac20e11bb2d12a9352ea28fc