Security readout for executives and security teams
Plain-English summary
CVE-2022-50717 is a Linux kernel flaw in the NVMe-over-TCP target component. A missing bounds check could let a malformed transfer tag cause out-of-bounds kernel access. Public sources provide no CVSS score and no evidence of active exploitation.
Executive priority
Treat as a targeted infrastructure hygiene issue. Prioritize storage hosts or kernel builds exposing NVMe-over-TCP. If nvmet-tcp is not used, handle through routine kernel patching.
Technical view
In nvmet_tcp_handle_h2c_data_pdu(), the Transfer Tag is used as an index to retrieve a command. The fix adds a bounds check to prevent out-of-bounds access. The issue affects Linux kernel nvmet-tcp code, with stable kernel fixes referenced by upstream commits.
Likely exposure
Systems are most relevant if they run Linux with NVMe-over-TCP target functionality enabled or exposed. General Linux servers not using nvmet-tcp are less likely to be practically exposed, though package applicability should still be checked.
Exploitation context
No KEV listing or cited source indicates active exploitation. The available description suggests an attacker would need to interact with the nvmet-tcp data path, likely requiring access to an NVMe-over-TCP target endpoint.
Researcher notes
Evidence is limited to the CVE record and upstream stable commits. No CVSS, CWE, exploit status, or detailed impact statement is provided. Avoid assuming remote code execution; describe impact as out-of-bounds kernel access unless vendor advisories add detail.
Mitigation direction
- Check Linux distribution advisories for CVE-2022-50717 applicability and fixed kernel packages.
- Update affected Linux kernels to versions containing the referenced stable fixes.
- Restrict access to NVMe-over-TCP target services to trusted storage networks.
- Disable nvmet-tcp where it is not required.
Validation and detection
- Inventory Linux hosts running NVMe-over-TCP target functionality.
- Confirm installed kernel version and vendor backport status.
- Review kernel package changelogs for the referenced upstream fix commits.
- Verify NVMe-over-TCP exposure is limited to intended networks.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50717 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/0d150ccd55dbfad36f55855b40b381884c98456eCVE reference
- https://git.kernel.org/stable/c/d5bb45f47b37d10f010355686b28c9ebacb361d4CVE reference
- https://git.kernel.org/stable/c/ec8adf767e1cfa7031f853b8c71ba1963f07df15CVE reference
- https://git.kernel.org/stable/c/fcf82e4553db911d10234ff2390cfd0e2aa854e4CVE reference
- https://git.kernel.org/stable/c/752593d04637ebdc87fd29cba81897f21ae053f0CVE reference
- https://git.kernel.org/stable/c/b6a545ffa2c192b1e6da4a7924edac5ba9f4ea2bCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.