LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50050: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf()

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() snprintf() returns the would-be-filled size when the string overflows the given buffer size, hence using this value may result in the buffer overflow (although it's unrealistic). This patch replaces with a safer version, scnprintf() for papering over such a potential issue.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel issue in Intel HDA/SOF audio code where a safer string-formatting function was needed to avoid a potential buffer overflow. The upstream note describes the overflow as unrealistic, and no CVSS score is provided.

Executive priority

Handle as routine kernel maintenance unless your environment has broad affected Linux exposure or vendor guidance raises severity. There is no provided evidence of active exploitation, CVSS severity, or urgent emergency patch requirement.

Technical view

The fix replaces snprintf() with scnprintf() because snprintf() returns the length that would have been written, which can be unsafe if that value is later used after truncation. The affected area is Linux ASoC SOF Intel HDA code. Stable kernel commits are referenced as fixes.

Likely exposure

Exposure appears limited to Linux kernels containing the affected ASoC SOF Intel HDA code. The CVE source lists Linux versions including 5.10, 5.15.63, 5.19.4, and 6.0 as affected. Confirm actual exposure through distribution advisories and backport status.

Exploitation context

The source bundle does not show KEV listing, public exploitation, exploit availability, or a practical attack path. The kernel description calls the overflow potential and says it is unrealistic, so business urgency should be guided by vendor patch status and fleet exposure.

Researcher notes

Evidence is sparse: no CWE, no CVSS, and no exploit context are provided. The strongest technical signal is the upstream commit rationale about snprintf() return semantics and the safer scnprintf() replacement.

Mitigation direction

  • Check Linux distribution advisories for CVE-2022-50050 coverage.
  • Apply vendor kernel updates incorporating the referenced stable fixes.
  • Prioritize systems with affected Intel HDA/SOF kernel code enabled.
  • Use normal kernel update testing before broad rollout.

Validation and detection

  • Inventory Linux kernel versions across managed assets.
  • Confirm whether distro packages include the referenced fix commits.
  • Identify systems using affected ASoC SOF Intel HDA code.
  • Validate kernel update success and post-update system stability.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50050 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux29c8e4398f02adacd429c7847dacc8aea5a0c2f1, 29c8e4398f02adacd429c7847dacc8aea5a0c2f1, 29c8e4398f02adacd429c7847dacc8aea5a0c2f1unaffected
LinuxLinux5.10, 0, 5.15.63, 5.19.4, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.