Security readout for executives and security teams
Plain-English summary
CVE-2022-50352 is a Linux kernel memory leak in the HNS/HNAE network driver path. Under a probing failure, kernel memory allocated for a device name may not be released. The main business risk is local availability impact on systems using affected kernels and relevant driver components.
Executive priority
Treat as a routine kernel availability issue unless affected driver components are present on sensitive Linux hosts. It does not currently warrant emergency response based on the provided evidence, but it should be folded into regular kernel patch cycles.
Technical view
The flaw is CWE-401 in hnae_ae_register(). If device_register() fails during module probing, the kobject reference count is not reduced to zero, so the dev_set_name() allocation leaks. The resolved fix calls put_device(), allowing kobject_cleanup() to free the name. CVSS 3.1 is 5.5 with local, low-privilege, availability-only impact.
Likely exposure
Exposure appears limited to affected Linux kernel versions where the HNS/HNAE network driver code is present and can be probed. The source lists affected versions including 4.4 through 6.1 ranges, but downstream distribution backports may change exact status.
Exploitation context
The source bundle does not show active exploitation, and KEV status is false. The CVSS vector requires local access with low privileges and no user interaction. The described condition depends on module probing and a device_register() failure path, not a remote network attack.
Researcher notes
The public record is clear on root cause and fix direction, but incomplete on practical exploitability across distributions. Validate exposure by kernel branch, backport status, and driver reachability. Avoid assuming all Linux systems are affected solely from the upstream version list.
Mitigation direction
- Upgrade to a kernel or distribution package containing the referenced stable fixes.
- Confirm vendor guidance for backported or vendor-maintained kernel branches.
- Prioritize systems where HNS/HNAE driver components are present or loadable.
- Track remediation through normal kernel vulnerability management and reboot workflows.
Validation and detection
- Compare running kernel versions against vendor advisories and the CVE affected ranges.
- Check whether hnae or hns_dsaf driver components exist on managed systems.
- Review kernel logs for probe failures or memory leak reports involving hnae.
- Confirm scanners recognize the fixed kernel package after update and reboot.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50352 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/a3c148955c22fe1d94d7a2096005679c1f22eddfCVE reference, Linux
- https://git.kernel.org/stable/c/3b78453cca046d3b03853f0d077ad3ad130db886CVE reference, Linux
- https://git.kernel.org/stable/c/7ae1345f6ad715acbcdc9e1ac28153684fd498bbCVE reference, Linux
- https://git.kernel.org/stable/c/dfc0337c6dceb6449403b33ecb141f4a1458a1e9CVE reference, Linux
- https://git.kernel.org/stable/c/2974f3b330ef25f5d34a4948d04290c2cd7802cfCVE reference, Linux
- https://git.kernel.org/stable/c/91f8f5342bee726ed5692583d58f69e7cc9ae60eCVE reference, Linux
- https://git.kernel.org/stable/c/02dc0db19d944b4a90941db505ecf1aaec714be4CVE reference, Linux
- https://git.kernel.org/stable/c/ff2f5ec5d009844ec28f171123f9e58750cef4bfCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.