LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50030: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input Malformed user input to debugfs results in buffer overflow crashes. Adapt input string lengths to fit within internal buffers, leaving space for NULL terminators.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50030 is a Linux kernel lpfc driver flaw where malformed input through debugfs can cause buffer-overflow crashes. The main business risk is local availability impact on systems using this storage driver. Public sources do not show active exploitation or a CVSS score.

Executive priority

Treat as a targeted availability risk. Patch during the next maintenance window, with higher priority for storage infrastructure or systems where a local crash would cause significant downtime.

Technical view

The Linux kernel scsi lpfc debugfs handling failed to size user-provided strings safely for internal buffers. The fix adjusts accepted input lengths and preserves space for null terminators. References are Linux stable commits; no CWE, CVSS, or exploit details are provided in the source bundle.

Likely exposure

Likely exposure is limited to Linux systems running affected kernel builds with the lpfc driver and its debugfs interface reachable by a local user or process. Internet-facing remote exposure is not indicated by the provided sources.

Exploitation context

The source describes malformed user input causing buffer-overflow crashes through debugfs. CISA KEV status is false in the provided data, and no cited source reports active exploitation. Evidence supports a local crash scenario, not confirmed code execution.

Researcher notes

Affected-version metadata is limited and commit-based. Validate against distro backports rather than upstream version numbers alone. Public sources provide no CVSS, CWE, proof-of-concept status, or evidence of exploitation in the wild.

Mitigation direction

  • Apply vendor kernel updates containing the relevant Linux stable lpfc fixes.
  • Prioritize storage-critical hosts where kernel crashes would disrupt operations.
  • Check distribution advisories for backported fixes and exact package versions.

Validation and detection

  • Inventory Linux kernel versions on systems using the lpfc driver.
  • Confirm whether vendor kernels include the referenced stable commits.
  • Check whether debugfs is present on affected hosts.
  • Track CISA KEV and vendor advisories for any exploitation updates.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50030 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxbd2cdd5e400f5914bc30d5cfb0a0185cf51e4424, bd2cdd5e400f5914bc30d5cfb0a0185cf51e4424, bd2cdd5e400f5914bc30d5cfb0a0185cf51e4424, bd2cdd5e400f5914bc30d5cfb0a0185cf51e4424, bd2cdd5e400f5914bc30d5cfb0a0185cf51e4424unaffected
LinuxLinux4.11, 0, 5.4.211, 5.10.138, 5.15.63, 5.19.4, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.