tee: add overflow check in register_shm_helper()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2022-50080
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2025-06-18 11:15:36 UTC
Updated2026-11-05 20:17:22 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: tee: add overflow check in register_shm_helper() With special lengths supplied by user space, register_shm_helper() has an integer overflow when calculating the number of pages covered by a supplied user space memory region. This causes internal_get_user_pages_fast() a helper function of pin_user_pages_fast() to do a NULL pointer dereference: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 Modules linked in: CPU: 1 PID: 173 Comm: optee_example_a Not tainted 5.19.0 #11 Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pc : internal_get_user_pages_fast+0x474/0xa80 Call trace: internal_get_user_pages_fast+0x474/0xa80 pin_user_pages_fast+0x24/0x4c register_shm_helper+0x194/0x330 tee_shm_register_user_buf+0x78/0x120 tee_ioctl+0xd0/0x11a0 __arm64_sys_ioctl+0xa8/0xec invoke_syscall+0x48/0x114 Fix this by adding an an explicit call to access_ok() in tee_shm_register_user_buf() to catch an invalid user space address early.

Risk And Classification

Primary CVSS: v3.1 5.5 MEDIUM from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Problem Types: CWE-476

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 033ddf12bcf5326b93bd604f50a7474a434a35f9 b37e0f17653c00b586cdbcdf0dbca475358ecffd git Not specified
CNA Linux Linux affected 033ddf12bcf5326b93bd604f50a7474a434a35f9 965333345fe952cc7eebc8e3a565ffc709441af2 git Not specified
CNA Linux Linux affected 033ddf12bcf5326b93bd604f50a7474a434a35f9 578c349570d2a912401963783b36e0ec7a25c053 git Not specified
CNA Linux Linux affected 033ddf12bcf5326b93bd604f50a7474a434a35f9 c12f0e6126ad223806a365084e86370511654bf1 git Not specified
CNA Linux Linux affected 033ddf12bcf5326b93bd604f50a7474a434a35f9 2f8e79a1a6128214cb9b205a9869341af5dfb16b git Not specified
CNA Linux Linux affected 033ddf12bcf5326b93bd604f50a7474a434a35f9 58c008d4d398f792ca67f35650610864725518fd git Not specified
CNA Linux Linux affected 033ddf12bcf5326b93bd604f50a7474a434a35f9 573ae4f13f630d6660008f1974c0a8a29c30e18a git Not specified
CNA Linux Linux affected 4.16 Not specified
CNA Linux Linux unaffected 4.16 semver Not specified
CNA Linux Linux unaffected 4.19.256 4.19.* semver Not specified
CNA Linux Linux unaffected 5.4.211 5.4.* semver Not specified
CNA Linux Linux unaffected 5.10.137 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.62 5.15.* semver Not specified
CNA Linux Linux unaffected 5.18.19 5.18.* semver Not specified
CNA Linux Linux unaffected 5.19.3 5.19.* semver Not specified
CNA Linux Linux unaffected 6.0 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/2f8e79a1a6128214cb9b205a9869341af5dfb16b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/573ae4f13f630d6660008f1974c0a8a29c30e18a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/b37e0f17653c00b586cdbcdf0dbca475358ecffd 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/c12f0e6126ad223806a365084e86370511654bf1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/578c349570d2a912401963783b36e0ec7a25c053 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/965333345fe952cc7eebc8e3a565ffc709441af2 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/58c008d4d398f792ca67f35650610864725518fd 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report