Security readout for executives and security teams
Plain-English summary
CVE-2022-50343 is a Linux kernel RapidIO bug where a failed device-add path can leak an allocated device name. The documented impact is availability, not data theft or tampering. Exploitation requires local access with low privileges, so business urgency is moderate and depends on whether affected kernels and RapidIO functionality are present.
Executive priority
Handle through normal kernel patch governance, with higher priority for critical systems using RapidIO or custom kernels. There is no cited active exploitation, but the availability impact justifies timely remediation in scheduled maintenance.
Technical view
The flaw is a CWE-401 memory leak in RapidIO error handling. If rio_add_device() fails after dev_set_name(), the allocated name may not be released. The fix uses put_device() on the error path so kobject_cleanup() and rio_release_dev() free the name and device object.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions or vendor kernels that include the vulnerable RapidIO code without the stable fix. The source bundle does not prove all listed kernels are vulnerable in every distribution because vendors may backport patches independently.
Exploitation context
The CVSS vector is local, low complexity, low privileges, no user interaction, with high availability impact only. The source bundle marks KEV as false and provides no evidence of active exploitation or public weaponization.
Researcher notes
The evidence is limited to the CVE description, CVSS, affected-version metadata, and Linux stable commit references. The affected-version list contains unusual duplicate hash-like entries, so distribution-specific validation is necessary before declaring exposure.
Mitigation direction
- Update affected Linux kernels to vendor builds containing the referenced stable fixes.
- Confirm distribution advisories because vendors may backport fixes without changing upstream version numbers.
- Prioritize systems where RapidIO support is enabled or operationally relevant.
- If immediate patching is not possible, follow vendor guidance for risk reduction.
Validation and detection
- Inventory Linux kernel versions and vendor package revisions across managed assets.
- Check whether RapidIO support is enabled, loaded, or required on in-scope systems.
- Compare installed kernels against vendor advisories and the referenced stable commits.
- Verify remediation through package metadata or source showing the corrected put_device() error path.
Public sources used
- CVE Program
- CVE List V5
- Linux stable commit 3b4676f274a6
- Linux stable commit c482cb0deb57
- Linux stable commit 80fad2e53eae
- Linux stable commit 440afd7fd9b1
- Linux stable commit 88fa351b20ca
- Linux stable commit ec3f04f74f50
- Linux stable commit c413f65011ff
- Linux stable commit 85fbf58b15c0
- Linux stable commit f9574cd48679
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50343 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/3b4676f274a6b5d001176f15d0542100bbf4b59aCVE reference
- https://git.kernel.org/stable/c/c482cb0deb57924335103fe592c379a076d867f8CVE reference
- https://git.kernel.org/stable/c/80fad2e53eaed2b3a2ff596575f65669e13ceda5CVE reference
- https://git.kernel.org/stable/c/440afd7fd9b164fdde6fc9da8c47d3d7f20dcce8CVE reference
- https://git.kernel.org/stable/c/88fa351b20ca300693a206ccd3c4b0e0647944d8CVE reference
- https://git.kernel.org/stable/c/ec3f04f74f50d0b6bac04d795c93c2b852753a7aCVE reference
- https://git.kernel.org/stable/c/c413f65011ff8caffabcde0e1c3ceede48a48d6fCVE reference
- https://git.kernel.org/stable/c/85fbf58b15c09d3a6a03098c1e42ebfe9002f39dCVE reference
- https://git.kernel.org/stable/c/f9574cd48679926e2a569e1957a5a1bcc8a719acCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.