Security readout for executives and security teams
Plain-English summary
CVE-2022-50781 is a Linux kernel AMD GPU driver bug. A value supplied through sysfs was not checked for negative input, allowing an out-of-bounds read in Vega20 power-management code. The public record does not provide CVSS, confirmed impact, or evidence of active exploitation.
Executive priority
Treat as a targeted kernel maintenance item, not an emergency based on current public evidence. Prioritize GPU compute, workstation, or shared Linux environments using AMDGPU. There is no cited active exploitation, but kernel memory-safety issues should be resolved through normal patch cycles.
Technical view
The issue is in amdgpu/pm, function vega20_odn_edit_dpm_table(), PP_OD_EDIT_VDDC_CURVE handling. input_index is capped at 2 but was not validated against negative values, causing an array underflow and out-of-bounds read. The value is user-controlled via sysfs. Kernel stable commits are referenced as the resolution.
Likely exposure
Exposure appears limited to Linux systems using the affected AMDGPU Vega20 power-management path and kernels containing the vulnerable code. Systems without relevant AMD GPU hardware or without this driver path enabled are less likely exposed. The affected-version data in the source bundle is incomplete and should be verified against distribution advisories.
Exploitation context
The source states the input comes from a user via sysfs, suggesting local access is required. No KEV listing is present, and the provided sources do not claim public exploitation. The record describes an out-of-bounds read, but does not define practical impact such as crash, information disclosure, or privilege escalation.
Researcher notes
Key uncertainty is impact. The record only states out-of-bounds read from negative sysfs input. Review the referenced stable commits and downstream backports to determine affected branches and whether access to the relevant sysfs interface requires specific privileges or hardware state.
Mitigation direction
- Update to a kernel containing the referenced stable fix commits.
- Check your Linux distribution advisory for backported fixes.
- Prioritize systems with AMDGPU Vega20 hardware or enabled amdgpu power-management sysfs access.
- Apply standard local-user access controls on shared GPU systems.
Validation and detection
- Inventory Linux hosts with AMDGPU hardware, especially Vega20-class GPUs.
- Compare running kernel packages against distribution fixed versions or referenced stable commits.
- Confirm the amdgpu power-management code path is present before prioritizing remediation.
- Track vendor advisories because CVSS and impact details are not provided.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2022-50781 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4d3dc0de9c46d9f73be6bac026e40b893e37ea21CVE reference
- https://git.kernel.org/stable/c/85273b4a7076ed5328c8ace02234e4e7e10972d5CVE reference
- https://git.kernel.org/stable/c/f289a38df0da4cfe4b50d04b1b9c3bc646fecd57CVE reference
- https://git.kernel.org/stable/c/a03625ad11b50429930f4c491d6c97e70f2ba89aCVE reference
- https://git.kernel.org/stable/c/8084bd0a64e278314b733993f388d83a86aa1183CVE reference
- https://git.kernel.org/stable/c/d27252b5706e51188aed7647126e44dcf9e940c1CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.