GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-50581 (GCVE-0-2022-50581)

Vulnerability from cvelistv5 – Published: 2025-10-22 13:23 – Updated: 2026-08-05 08:59
VLAI
Title
hfs: fix OOB Read in __hfs_brec_find
Summary
In the Linux kernel, the following vulnerability has been resolved: hfs: fix OOB Read in __hfs_brec_find Syzbot reported a OOB read bug: ================================================================== BUG: KASAN: slab-out-of-bounds in hfs_strcmp+0x117/0x190 fs/hfs/string.c:84 Read of size 1 at addr ffff88807eb62c4e by task kworker/u4:1/11 CPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted 6.1.0-rc6-syzkaller-00308-g644e9524388a #0 Workqueue: writeback wb_workfn (flush-7:0) Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report+0xcd/0x100 mm/kasan/report.c:495 hfs_strcmp+0x117/0x190 fs/hfs/string.c:84 __hfs_brec_find+0x213/0x5c0 fs/hfs/bfind.c:75 hfs_brec_find+0x276/0x520 fs/hfs/bfind.c:138 hfs_write_inode+0x34c/0xb40 fs/hfs/inode.c:462 write_inode fs/fs-writeback.c:1440 [inline] If the input inode of hfs_write_inode() is incorrect: struct inode struct hfs_inode_info struct hfs_cat_key struct hfs_name u8 len # len is greater than HFS_NAMELEN(31) which is the maximum length of an HFS filename OOB read occurred: hfs_write_inode() hfs_brec_find() __hfs_brec_find() hfs_cat_keycmp() hfs_strcmp() # OOB read occurred due to len is too large Fix this by adding a Check on len in hfs_write_inode() before calling hfs_brec_find().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8c40f2dbae603ef0bd21e87c63f54ec59fd88256 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c886c10a6eddb99923b315f42bf63f448883ef9a (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 2344f17c0a89c181ab1a9fef57fd8c3bddfd6e30 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 90103ccb6e60aa4efe48993d23d6a528472f2233 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4fd3a11804c8877ff11fec59c5c53f1635331e3e (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 367296925c7625c3969d2a78d7a3e1dee161beb5 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e9e692917c6e10a7066c7a6d092dcdc3d4e329f3 (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < bfc9d8f27f89717431a6aecce42ae230b437433f (git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 8d824e69d9f3fa3121b2dda25053bae71e2460d2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.12
Unaffected: 0 , < 2.6.12 (semver)
Unaffected: 4.9.337 , ≤ 4.9.* (semver)
Unaffected: 4.14.303 , ≤ 4.14.* (semver)
Unaffected: 4.19.270 , ≤ 4.19.* (semver)
Unaffected: 5.4.229 , ≤ 5.4.* (semver)
Unaffected: 5.10.163 , ≤ 5.10.* (semver)
Unaffected: 5.15.86 , ≤ 5.15.* (semver)
Unaffected: 6.0.16 , ≤ 6.0.* (semver)
Unaffected: 6.1.2 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/hfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8c40f2dbae603ef0bd21e87c63f54ec59fd88256",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c886c10a6eddb99923b315f42bf63f448883ef9a",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "2344f17c0a89c181ab1a9fef57fd8c3bddfd6e30",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "90103ccb6e60aa4efe48993d23d6a528472f2233",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "4fd3a11804c8877ff11fec59c5c53f1635331e3e",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "367296925c7625c3969d2a78d7a3e1dee161beb5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "e9e692917c6e10a7066c7a6d092dcdc3d4e329f3",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "bfc9d8f27f89717431a6aecce42ae230b437433f",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "8d824e69d9f3fa3121b2dda25053bae71e2460d2",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/hfs/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.337",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.303",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.229",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.163",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.86",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.337",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.303",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.270",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.229",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.163",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.86",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.16",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix OOB Read in __hfs_brec_find\n\nSyzbot reported a OOB read bug:\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in hfs_strcmp+0x117/0x190\nfs/hfs/string.c:84\nRead of size 1 at addr ffff88807eb62c4e by task kworker/u4:1/11\nCPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted\n6.1.0-rc6-syzkaller-00308-g644e9524388a #0\nWorkqueue: writeback wb_workfn (flush-7:0)\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106\n print_address_description+0x74/0x340 mm/kasan/report.c:284\n print_report+0x107/0x1f0 mm/kasan/report.c:395\n kasan_report+0xcd/0x100 mm/kasan/report.c:495\n hfs_strcmp+0x117/0x190 fs/hfs/string.c:84\n __hfs_brec_find+0x213/0x5c0 fs/hfs/bfind.c:75\n hfs_brec_find+0x276/0x520 fs/hfs/bfind.c:138\n hfs_write_inode+0x34c/0xb40 fs/hfs/inode.c:462\n write_inode fs/fs-writeback.c:1440 [inline]\n\nIf the input inode of hfs_write_inode() is incorrect:\nstruct inode\n  struct hfs_inode_info\n    struct hfs_cat_key\n      struct hfs_name\n        u8 len # len is greater than HFS_NAMELEN(31) which is the\nmaximum length of an HFS filename\n\nOOB read occurred:\nhfs_write_inode()\n  hfs_brec_find()\n    __hfs_brec_find()\n      hfs_cat_keycmp()\n        hfs_strcmp() # OOB read occurred due to len is too large\n\nFix this by adding a Check on len in hfs_write_inode() before calling\nhfs_brec_find()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires mounting a crafted HFS filesystem image locally (loop device, removable media, or similar); the bug is in fs/hfs writeback, not in network packet processing.\nAC:L - A crafted image reliably triggers the OOB on mount/writeback (syzbot C repro mounts and crashes without races or special timing), so success does not depend on conditions outside the attacker\u2019s control.\nPR:L - Triggering the bug needs the ability to mount an HFS image (CAP_SYS_ADMIN or equivalent mount assistance such as udisks); this is treated as low privileges consistent with local filesystem image attack scenarios, not unauthenticated access.\nUI:N - The attacker supplies and mounts their own malicious HFS image; writeback then hits hfs_write_inode without requiring a separate victim action beyond the attacker\u2019s mount.\nS:U - Impact stays within the local kernel/host authority (slab OOB read and possible oops during HFS catalog writeback); there is no VM, IOMMU, or other security-authority boundary crossing.\nC:H - hfs_strcmp uses an unchecked CName.len (up to 255) against a 31-byte name array, reading far past the kmalloc\u2019d find-key buffer into adjacent slab memory and enabling substantial kernel memory disclosure.\nI:H - The OOB read poisons catalog key comparison in hfs_write_inode, which then hfs_bnode_write\u2019s inode metadata to the selected record; combined with slab-OOB exploit potential this is scored as high integrity impact under the overestimate rule.\nA:H - The slab out-of-bounds access can oops/panic the kernel during writeback (as in the KASAN syzbot report on wb_workfn), causing a full availability loss."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:59:11.666Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8c40f2dbae603ef0bd21e87c63f54ec59fd88256"
        },
        {
          "url": "https://git.kernel.org/stable/c/c886c10a6eddb99923b315f42bf63f448883ef9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/2344f17c0a89c181ab1a9fef57fd8c3bddfd6e30"
        },
        {
          "url": "https://git.kernel.org/stable/c/90103ccb6e60aa4efe48993d23d6a528472f2233"
        },
        {
          "url": "https://git.kernel.org/stable/c/4fd3a11804c8877ff11fec59c5c53f1635331e3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/367296925c7625c3969d2a78d7a3e1dee161beb5"
        },
        {
          "url": "https://git.kernel.org/stable/c/e9e692917c6e10a7066c7a6d092dcdc3d4e329f3"
        },
        {
          "url": "https://git.kernel.org/stable/c/bfc9d8f27f89717431a6aecce42ae230b437433f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8d824e69d9f3fa3121b2dda25053bae71e2460d2"
        }
      ],
      "title": "hfs: fix OOB Read in __hfs_brec_find",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50581",
    "datePublished": "2025-10-22T13:23:33.421Z",
    "dateReserved": "2025-10-22T13:20:23.762Z",
    "dateUpdated": "2026-08-05T08:59:11.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-50581",
      "date": "2026-09-19",
      "epss": "0.00172",
      "percentile": "0.06929"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/hfs/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "8c40f2dbae603ef0bd21e87c63f54ec59fd88256",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c886c10a6eddb99923b315f42bf63f448883ef9a",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2344f17c0a89c181ab1a9fef57fd8c3bddfd6e30",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "90103ccb6e60aa4efe48993d23d6a528472f2233",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4fd3a11804c8877ff11fec59c5c53f1635331e3e",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "367296925c7625c3969d2a78d7a3e1dee161beb5",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e9e692917c6e10a7066c7a6d092dcdc3d4e329f3",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bfc9d8f27f89717431a6aecce42ae230b437433f",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8d824e69d9f3fa3121b2dda25053bae71e2460d2",
                    "status": "affected",
                    "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/hfs/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.12"
                  },
                  {
                    "lessThan": "2.6.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.9.*",
                    "status": "unaffected",
                    "version": "4.9.337",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.14.*",
                    "status": "unaffected",
                    "version": "4.14.303",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.270",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.229",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.163",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.86",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.0.*",
                    "status": "unaffected",
                    "version": "6.0.16",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhfs: fix OOB Read in __hfs_brec_find\n\nSyzbot reported a OOB read bug:\n\n==================================================================\nBUG: KASAN: slab-out-of-bounds in hfs_strcmp+0x117/0x190\nfs/hfs/string.c:84\nRead of size 1 at addr ffff88807eb62c4e by task kworker/u4:1/11\nCPU: 1 PID: 11 Comm: kworker/u4:1 Not tainted\n6.1.0-rc6-syzkaller-00308-g644e9524388a #0\nWorkqueue: writeback wb_workfn (flush-7:0)\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106\n print_address_description+0x74/0x340 mm/kasan/report.c:284\n print_report+0x107/0x1f0 mm/kasan/report.c:395\n kasan_report+0xcd/0x100 mm/kasan/report.c:495\n hfs_strcmp+0x117/0x190 fs/hfs/string.c:84\n __hfs_brec_find+0x213/0x5c0 fs/hfs/bfind.c:75\n hfs_brec_find+0x276/0x520 fs/hfs/bfind.c:138\n hfs_write_inode+0x34c/0xb40 fs/hfs/inode.c:462\n write_inode fs/fs-writeback.c:1440 [inline]\n\nIf the input inode of hfs_write_inode() is incorrect:\nstruct inode\n  struct hfs_inode_info\n    struct hfs_cat_key\n      struct hfs_name\n        u8 len # len is greater than HFS_NAMELEN(31) which is the\nmaximum length of an HFS filename\n\nOOB read occurred:\nhfs_write_inode()\n  hfs_brec_find()\n    __hfs_brec_find()\n      hfs_cat_keycmp()\n        hfs_strcmp() # OOB read occurred due to len is too large\n\nFix this by adding a Check on len in hfs_write_inode() before calling\nhfs_brec_find()."
          }
        ],
        "id": "CVE-2022-50581",
        "lastModified": "2026-08-04T10:18:19.893",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2025-10-22T14:15:43.147",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2344f17c0a89c181ab1a9fef57fd8c3bddfd6e30"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/367296925c7625c3969d2a78d7a3e1dee161beb5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4fd3a11804c8877ff11fec59c5c53f1635331e3e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8c40f2dbae603ef0bd21e87c63f54ec59fd88256"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8d824e69d9f3fa3121b2dda25053bae71e2460d2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/90103ccb6e60aa4efe48993d23d6a528472f2233"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bfc9d8f27f89717431a6aecce42ae230b437433f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c886c10a6eddb99923b315f42bf63f448883ef9a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e9e692917c6e10a7066c7a6d092dcdc3d4e329f3"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Deferred"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:16:43+00:00",
      "cve": "CVE-2022-50581",
      "id": "CVE-2022-50581",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: hfs: fix OOB Read in __hfs_brec_find",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-50581.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.