Security readout for executives and security teams
Plain-English summary
CVE-2022-50389 is a Linux kernel memory leak in TPM initialization. A local user with low privileges could potentially contribute to availability loss, but the sources show no confidentiality or integrity impact and no active exploitation evidence.
Executive priority
Treat this as routine-to-moderate patching. It is not supported as actively exploited, but availability-only kernel flaws still matter on shared infrastructure and systems with strict uptime requirements.
Technical view
In tpm_crb, crb_acpi_add() retrieved the ACPI TPM2 table for start-method data but did not release it after initialization. The kernel fix adds acpi_put_table() to prevent a CWE-401 memory leak. CVSS is 5.5: local attack vector, low privileges, availability impact only.
Likely exposure
Exposure is limited to Linux systems running affected kernel versions or unpatched downstream builds containing the TPM CRB ACPI memory leak. Risk is most relevant where TPM2 CRB ACPI support is present. Distro-specific backport status is not provided in the source bundle.
Exploitation context
The CVE record marks KEV as false, and the provided sources do not cite active exploitation or public exploit use. Any practical concern is local availability degradation, not remote compromise, data theft, or privilege escalation based on the cited evidence.
Researcher notes
The source evidence identifies a missing ACPI table release in Linux tpm_crb and lists stable commit references. It does not provide exploit details, distro package mappings, or environmental prerequisites beyond the affected Linux kernel and TPM2 ACPI path.
Mitigation direction
- Update affected Linux kernels to versions containing the stable tpm_crb fix.
- Use distribution kernel security updates where available, because fixes may be backported.
- Check vendor guidance for exact package versions and support status.
- Prioritize shared or multi-user Linux systems where local users are less trusted.
Validation and detection
- Inventory Linux kernel versions across affected hosts.
- Compare running kernels with vendor advisories and the listed stable kernel commits.
- Confirm downstream changelogs include the tpm_crb acpi_put_table fix.
- Regression test TPM-dependent boot, attestation, and encryption workflows after patching.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-401: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-50389 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/08fd965521d0e172d540cf945517810895fcb199CVE reference
- https://git.kernel.org/stable/c/1af2232b13837ce0f3a082b9f43735b09aafc367CVE reference
- https://git.kernel.org/stable/c/927860dfa161ae8392a264197257dbdc52b26b0fCVE reference
- https://git.kernel.org/stable/c/0bd9b4be721c776f77adcaf34105dfca3007ddb9CVE reference
- https://git.kernel.org/stable/c/986cd9a9b95423e35a2cbb8e9105aec0e0d7f337CVE reference
- https://git.kernel.org/stable/c/2fcd3dc8b97a14f1672729c86b7041a1a89b052aCVE reference
- https://git.kernel.org/stable/c/b0785edaf649e5f04dc7f75533e810f4c00e4106CVE reference
- https://git.kernel.org/stable/c/37e90c374dd11cf4919c51e847c6d6ced0abc555CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Release of Memory after Effective Lifetime
Missing Release of Memory after Effective Lifetime represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.