LiveActive security incident?Get immediate response
CVE Record

CVE-2022-50763: crypto: marvell/octeontx - prevent integer overflows

In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - prevent integer overflows The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you can do to protect yourself. Still we try to limit the damage as much as possible. Also Smatch marks any data read from the filesystem as untrusted and prints warnings if it not capped correctly. The "code_length * 2" can overflow. The round_up(ucode_size, 16) + sizeof() expression can overflow too. Prevent these overflows.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2022-50763 is a Linux kernel issue in the Marvell OcteonTX crypto driver. A firmware-provided length value could overflow arithmetic used by the driver. The source notes that if firmware is untrusted, protection is limited. There is no CVSS score, no CISA KEV listing, and no cited evidence of active exploitation.

Executive priority

Treat this as a targeted kernel maintenance issue, not a broad emergency based on current evidence. Prioritize embedded, appliance, or server platforms using Marvell OcteonTX crypto components, and confirm vendor-patched kernel availability through normal change management.

Technical view

The flaw involves unchecked integer arithmetic around firmware-derived code_length in crypto/marvell/octeontx. Specifically, code_length * 2 and round_up(ucode_size, 16) + sizeof() could overflow. Kernel stable commits add overflow prevention. Affected data provided lists Linux versions including 5.7, 5.10.150, 5.15.75, 5.19.17, 6.0.3, and 6.1.

Likely exposure

Exposure appears limited to Linux systems using the Marvell OcteonTX crypto driver and related firmware loading path. Systems without this hardware, driver, or firmware dependency are less likely to be exposed. Version impact should be confirmed against the running kernel and distribution backports.

Exploitation context

The public bundle does not identify active exploitation, public exploit code, or a complete impact statement. The issue depends on firmware-provided data being processed by the kernel driver. The upstream text emphasizes that untrusted firmware is already a serious trust boundary problem.

Researcher notes

Evidence is limited to the CVE record and Linux stable commits. No CVSS, CWE, exploit status, or concrete impact is provided. Avoid over-scoping beyond the Marvell OcteonTX crypto driver path and firmware-derived integer overflow described in the source.

Mitigation direction

  • Check vendor or distribution advisories for kernel updates containing the referenced stable commits.
  • Prioritize systems using Marvell OcteonTX crypto hardware or firmware.
  • Use trusted firmware sources and maintain firmware integrity controls.
  • Upgrade to a vendor-supported kernel build with the overflow checks backported.

Validation and detection

  • Inventory Linux systems with Marvell OcteonTX crypto hardware or driver enabled.
  • Compare kernel package changelogs against the referenced stable commit IDs.
  • Confirm whether distribution kernels have backported the fix.
  • Review firmware sourcing and integrity controls for affected platforms.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2022-50763 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxd9110b0b01ff1cd02751cd5c2c94e938a8906083, d9110b0b01ff1cd02751cd5c2c94e938a8906083, d9110b0b01ff1cd02751cd5c2c94e938a8906083, d9110b0b01ff1cd02751cd5c2c94e938a8906083, d9110b0b01ff1cd02751cd5c2c94e938a8906083unaffected
LinuxLinux5.7, 0, 5.10.150, 5.15.75, 5.19.17, 6.0.3, 6.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.