LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50370: i2c: designware: Fix handling of real but unexpected device interrupts

In the Linux kernel, the following vulnerability has been resolved: i2c: designware: Fix handling of real but unexpected device interrupts Commit c7b79a752871 ("mfd: intel-lpss: Add Intel Alder Lake PCH-S PCI IDs") caused a regression on certain Gigabyte motherboards for Intel Alder Lake-S where system crashes to NULL pointer dereference in i2c_dw_xfer_msg() when system resumes from S3 sleep state ("deep"). I was able to debug the issue on Gigabyte Z690 AORUS ELITE and made following notes: - Issue happens when resuming from S3 but not when resuming from "s2idle" - PCI device 00:15.0 == i2c_designware.0 is already in D0 state when system enters into pci_pm_resume_noirq() while all other i2c_designware PCI devices are in D3. Devices were runtime suspended and in D3 prior entering into suspend - Interrupt comes after pci_pm_resume_noirq() when device interrupts are re-enabled - According to register dump the interrupt really comes from the i2c_designware.0. Controller is enabled, I2C target address register points to a one detectable I2C device address 0x60 and the DW_IC_RAW_INTR_STAT register START_DET, STOP_DET, ACTIVITY and TX_EMPTY bits are set indicating completed I2C transaction. My guess is that the firmware uses this controller to communicate with an on-board I2C device during resume but does not disable the controller before giving control to an operating system. I was told the UEFI update fixes this but never the less it revealed the driver is not ready to handle TX_EMPTY (or RX_FULL) interrupt when device is supposed to be idle and state variables are not set (especially the dev->msgs pointer which may point to NULL or stale old data). Introduce a new software status flag STATUS_ACTIVE indicating when the controller is active in driver point of view. Now treat all interrupts that occur when is not set as unexpected and mask all interrupts from the controller.

MediumCVSS 5.5Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel availability bug in the DesignWare I2C driver. On some Intel Alder Lake-S systems, especially reported Gigabyte motherboards, resuming from S3 sleep can trigger an unexpected device interrupt and crash the system. It does not indicate data theft or privilege escalation in the provided sources.

Executive priority

Treat as a targeted stability risk, not an emergency breach indicator. Prioritize patching affected Linux workstations or appliances where sleep/resume crashes disrupt operations, especially known Gigabyte Alder Lake-S systems.

Technical view

The driver could process TX_EMPTY or RX_FULL interrupts while it considered the controller idle, leaving state such as dev->msgs unset, NULL, or stale. The kernel fix adds STATUS_ACTIVE and masks unexpected interrupts when the controller is not active from the driver’s perspective.

Likely exposure

Exposure is most relevant to Linux endpoints using the affected kernel ranges with Intel Alder Lake-S DesignWare I2C hardware and S3 deep sleep. Systems not using S3 sleep, not using this controller, or already carrying the stable kernel fixes are less likely exposed.

Exploitation context

The CVSS vector is local, low complexity, low privilege, no user interaction, with high availability impact. The bundle states KEV is false and provides no evidence of active exploitation or public weaponization.

Researcher notes

The root issue is defensive interrupt handling during resume when firmware may leave the controller active. Evidence supports denial of service through kernel crash only. Affected-version boundaries and distro backports require vendor-specific confirmation.

Mitigation direction

  • Update to a Linux kernel containing the referenced stable fixes.
  • Check vendor or distribution advisories for fixed package versions.
  • Review motherboard OEM UEFI updates for affected Gigabyte Alder Lake-S systems.
  • Prefer vendor guidance before applying operational workarounds.
  • Track fleet systems that use S3 deep sleep until patched.

Validation and detection

  • Inventory Linux kernel versions and vendor backport status.
  • Check whether systems use i2c-designware PCI on Intel Alder Lake-S hardware.
  • Review crash logs for NULL dereference in i2c_dw_xfer_msg after S3 resume.
  • Confirm whether the kernel includes one of the referenced stable commits.
  • Verify affected endpoints resume from S3 without kernel crashes after remediation.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-476: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2022-50370 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.5CVSS 3.1MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE score

Vulnerability scoring details

Base CVSS 3.1 score

5.5Medium
CVSS 3.1 vector shape for CVE-2022-50370Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc7b79a75287141cef5bbaeaf1c942269c08cd52e, c7b79a75287141cef5bbaeaf1c942269c08cd52e, c7b79a75287141cef5bbaeaf1c942269c08cd52e, c7b79a75287141cef5bbaeaf1c942269c08cd52eunaffected
LinuxLinux5.12, 0, 5.15.75, 5.19.17, 6.0.3, 6.1affected
Weakness

CWE details

CWE-476

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-476 · source CWE mapping

NULL Pointer Dereference

NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs