LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50167: bpf: fix potential 32-bit overflow when accessing ARRAY map element

In the Linux kernel, the following vulnerability has been resolved: bpf: fix potential 32-bit overflow when accessing ARRAY map element If BPF array map is bigger than 4GB, element pointer calculation can overflow because both index and elem_size are u32. Fix this everywhere by forcing 64-bit multiplication. Extract this formula into separate small helper and use it consistently in various places. Speculative-preventing formula utilizing index_mask trick is left as is, but explicit u64 casts are added in both places.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This Linux kernel flaw is a calculation bug in BPF array maps. Very large maps, over 4GB, could trigger a 32-bit integer overflow when locating an element. Business urgency depends on whether systems run affected kernels and expose BPF to users or workloads.

Executive priority

Treat as a targeted kernel maintenance issue until severity and exploitability are clarified. Prioritize shared, multi-tenant, and developer-access systems where BPF exposure is more relevant.

Technical view

The kernel BPF ARRAY map element pointer calculation used u32 index and elem_size values, allowing multiplication overflow for maps larger than 4GB. The upstream fix forces 64-bit multiplication and centralizes the formula, including speculative-access masking paths.

Likely exposure

Exposure is limited to Linux systems running affected kernel builds with BPF array map functionality. The source bundle lists Linux kernel impact, but does not provide distro package mappings or full environmental prerequisites.

Exploitation context

No active exploitation is cited, and the CVE is not marked KEV in the source bundle. The available evidence describes a resolved kernel memory calculation flaw, not public exploitation or weaponized use.

Researcher notes

Evidence is incomplete for CVSS, CWE, exploitability, and distro-specific fixes. Analysis should focus on affected kernel lineage, BPF access controls, and whether the stable commits are present in deployed builds.

Mitigation direction

  • Update to a vendor-supported kernel containing the referenced upstream stable fixes.
  • Check Linux distribution advisories for package-specific affected and fixed versions.
  • Restrict unprivileged BPF where operationally feasible and vendor-supported.
  • Prioritize systems where untrusted users or workloads can interact with BPF.

Validation and detection

  • Inventory Linux kernel versions across servers, containers hosts, and cloud images.
  • Map kernel packages to distribution advisories for CVE-2022-50167.
  • Confirm whether deployed kernels include the referenced upstream commits.
  • Review whether unprivileged BPF access is enabled on exposed multi-user systems.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50167 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc85d69135a9175c50a823d04d62d932312d037b3, c85d69135a9175c50a823d04d62d932312d037b3, c85d69135a9175c50a823d04d62d932312d037b3unaffected
LinuxLinux5.3, 0, 5.18.18, 5.19.2, 6.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.