LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50255: tracing: Fix reading strings from synthetic events

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix reading strings from synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]' > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is that the synthetic event field "char file[]" will read the value given to it as a string without any memory checks to make sure the address is valid. The above example will pass in the user space address and the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that can read strings safely (and actually succeed when the address is from user space and the memory is mapped in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2022-50255 is a Linux kernel tracing bug that can crash the system when synthetic events read a string from an unsafe address. The source describes a kernel oops, not data theft or remote compromise. Business urgency depends on where affected kernels are deployed and who can configure kernel tracing.

Executive priority

Treat this as a stability and availability risk for Linux infrastructure, not as a confirmed breach indicator. Patch during the next kernel maintenance window, faster for shared systems or environments where tracing controls are exposed beyond core administrators.

Technical view

The flaw is in Linux kernel tracing synthetic events. A synthetic field such as a string could be treated as a normal kernel string without validating the address, causing strlen() or strscpy() to fault when the address points to user space. The fix uses safer trace_kprobe and trace_eprobe string-reading helpers.

Likely exposure

Exposure is most likely on Linux systems running affected kernel versions listed in the CVE data, including 5.10, 5.15.75, 5.19.17, 6.0.3, and 6.1. Practical exposure appears tied to users or processes able to configure tracing under /sys/kernel/tracing.

Exploitation context

The bundle does not report active exploitation, and KEV is false. The public description shows crash-triggering tracing configuration, so the known impact is local denial of service through kernel oops. No remote attack path or privilege escalation is stated in the supplied sources.

Researcher notes

Evidence is limited to the CVE text and Linux stable commit references. The issue is a missing safe string-read path in synthetic event handling. The supplied data contains no CVSS, CWE, exploit-in-the-wild report, or vendor-specific package status.

Mitigation direction

  • Check Linux vendor advisories and kernel packages for CVE-2022-50255 fixes.
  • Update affected kernels to a release containing the referenced stable commits.
  • Restrict access to kernel tracing controls to trusted administrators only.
  • Prioritize systems where untrusted users can influence tracing configuration.

Validation and detection

  • Inventory running kernel versions across Linux servers and appliances.
  • Compare installed kernel builds with vendor fixed versions for CVE-2022-50255.
  • Confirm kernel packages include the referenced stable tracing fix commits.
  • Review permissions and operational access to /sys/kernel/tracing.
  • Check logs for unexplained kernel oops events involving tracing synthetic events.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50255 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxbd82631d7ccdc894af2738e47abcba2cb6e7dea9, bd82631d7ccdc894af2738e47abcba2cb6e7dea9, bd82631d7ccdc894af2738e47abcba2cb6e7dea9, bd82631d7ccdc894af2738e47abcba2cb6e7dea9unaffected
LinuxLinux5.10, 0, 5.15.75, 5.19.17, 6.0.3, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.