LiveActive security incident?Get immediate response
CVE Record

CVE-2022-49870: capabilities: fix undefined behavior in bit shift for CAP_TO_MASK

In the Linux kernel, the following vulnerability has been resolved: capabilities: fix undefined behavior in bit shift for CAP_TO_MASK Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in security/commoncap.c:1252:2 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c cap_task_prctl+0x561/0x6f0 security_task_prctl+0x5a/0xb0 __x64_sys_prctl+0x61/0x8f0 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK>

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-49870 is a Linux kernel bug in capability handling. A signed bit shift can produce undefined behavior and a UBSAN warning when the kernel processes a related prctl path. The public record does not provide CVSS, impact severity, or evidence of exploitation.

Executive priority

Treat this as routine kernel hygiene unless vendor guidance raises severity. There is no supplied evidence of active exploitation, but kernel updates should remain in normal maintenance windows.

Technical view

The issue is in CAP_TO_MASK logic used by Linux capability code. Shifting signed value 1 by 31 bits is undefined for int, and the fix changes the significant bit to unsigned. The source trace places the warning in security/commoncap.c through cap_task_prctl and __x64_sys_prctl.

Likely exposure

Exposure is limited to Linux kernels listed as affected, including multiple stable lines up to the fixed releases noted in the record. Downstream distributions may differ if they backported the referenced stable commits.

Exploitation context

The source bundle shows no KEV listing, no public exploit evidence, and no CVSS score. The observable condition is a UBSAN shift-out-of-bounds warning on a local kernel syscall path, not a documented remote attack.

Researcher notes

Evidence is sparse: no CVSS, CWE, exploit status, or detailed impact is supplied. The strongest technical signal is the upstream fix for undefined signed shift behavior in capability mask handling.

Mitigation direction

  • Update Linux kernels through the distribution or vendor-supported channel.
  • Confirm the installed kernel includes the referenced stable commit for its branch.
  • Check vendor advisories for backport status and package-specific guidance.
  • Prioritize systems where kernel warnings or capability-related instability are observed.

Validation and detection

  • Inventory Linux kernel versions across servers, endpoints, and appliances.
  • Map each kernel to vendor advisories or the referenced stable commits.
  • Review kernel logs for UBSAN shift-out-of-bounds warnings in commoncap.c.
  • Confirm patched hosts report the expected vendor kernel build.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-49870 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
9Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxe338d263a76af78fe8f38a72131188b58fceb591, e338d263a76af78fe8f38a72131188b58fceb591, e338d263a76af78fe8f38a72131188b58fceb591, e338d263a76af78fe8f38a72131188b58fceb591, e338d263a76af78fe8f38a72131188b58fceb591, e338d263a76af78fe8f38a72131188b58fceb591, e338d263a76af78fe8f38a72131188b58fceb591, e338d263a76af78fe8f38a72131188b58fceb591unaffected
LinuxLinux2.6.25, 0, 4.9.334, 4.14.300, 4.19.267, 5.4.225, 5.10.155, 5.15.79, 6.0.9, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.