5.5

CVE-2022-50080: tee: add overflow check in register_shm_helper()

Analyzed
AliasesUBUNTU-CVE-2022-50080DEBIAN-CVE-2022-50080
Published 18-06-2025Last modified 11-05-2026

Vulnerability summary

CVE-2022-50080 is a medium (CVSS 5.5) NULL Pointer Dereference vulnerability in linux. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 19% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.27%
0%100%
Low · +0.01 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1
RHSA-2024:2394SUSE-SU-2025:03204-1

Timeline

  1. 18-06-2025
    PublishedVulnerability first disclosed.
  2. 11-05-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: tee: add overflow check in register_shm_helper() With special lengths supplied by user space, register_shm_helper() has an integer overflow when calculating the number of pages covered by a supplied user space memory region. This causes internal_get_user_pages_fast() a helper function of pin_user_pages_fast() to do a NULL pointer dereference: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 Modules linked in: CPU: 1 PID: 173 Comm: optee_example_a Not tainted 5.19.0 #11 Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 pc : internal_get_user_pages_fast+0x474/0xa80 Call trace: internal_get_user_pages_fast+0x474/0xa80 pin_user_pages_fast+0x24/0x4c register_shm_helper+0x194/0x330 tee_shm_register_user_buf+0x78/0x120 tee_ioctl+0xd0/0x11a0 __arm64_sys_ioctl+0xa8/0xec invoke_syscall+0x48/0x114 Fix this by adding an an explicit call to access_ok() in tee_shm_register_user_buf() to catch an invalid user space address early.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.27%

Chance of exploitation in the next 30 days

Percentile

19%

Versus all other CVEs

30-day change

Increase +0.01 pp

From 0.26% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu107 products
  • linux< 5.4.0-132.148 | < 5.15.0-53.59
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.4.0-1089.97 | < 5.15.0-1023.27
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 033ddf12bcf5326b93bd604f50a7474a434a35f9, < b37e0f17653c00b586cdbcdf0dbca475358ecffd | ≥ 033ddf12bcf5326b93bd604f50a7474a434a35f9, < 965333345fe952cc7eebc8e3a565ffc709441af2 | ≥ 033ddf12bcf5326b93bd604f50a7474a434a35f9, < 578c349570d2a912401963783b36e0ec7a25c053 | ≥ 033ddf12bcf5326b93bd604f50a7474a434a35f9, < c12f0e6126ad223806a365084e86370511654bf1 | ≥ 033ddf12bcf5326b93bd604f50a7474a434a35f9, < 2f8e79a1a6128214cb9b205a9869341af5dfb16b | ≥ 033ddf12bcf5326b93bd604f50a7474a434a35f9, < 58c008d4d398f792ca67f35650610864725518fd | ≥ 033ddf12bcf5326b93bd604f50a7474a434a35f9, < 573ae4f13f630d6660008f1974c0a8a29c30e18a | 4.16
  • linux_kernel≥ 4.16, < 4.19.256 | ≥ 4.20, < 5.4.211 | ≥ 5.5, < 5.10.137 | ≥ 5.11, < 5.15.62 | ≥ 5.16, < 5.18.19 | ≥ 5.19, < 5.19.3 | 6.0:rc1
Debian1 product
  • linux< 6.0.2-1

3 vendors · 110 products

References

10 links