Security readout for executives and security teams
Plain-English summary
This Linux kernel issue affects PowerPC RTAS panic handling. When the system is already crashing, the kernel may hang while trying to read device-tree data. The main business impact is reduced reliability during severe failures, including failed panic termination or delayed recovery. It is not described as data theft or remote code execution.
Executive priority
Handle through normal kernel maintenance unless PowerPC systems support critical services requiring reliable crash recovery. For those systems, prioritize earlier because the failure mode can interfere with recovery during an already severe outage.
Technical view
rtas_os_term() runs during panic and previously traversed the /rtas device-tree node, involving locking and local IRQ state changes. If panic occurs while devtree_lock is held, the panic path can hang. The kernel fix caches the relevant RTAS characteristics at boot and treats ibm,extended-os-term as a boolean property.
Likely exposure
Exposure appears limited to Linux systems on PowerPC platforms using RTAS behavior. The CVE lists Linux kernel versions including 2.6.16 and several stable lines through 6.2 as affected, with stable kernel commits referenced as fixes. Non-PowerPC Linux systems are not indicated by the provided sources.
Exploitation context
No CISA KEV listing or provided source indicates active exploitation. The issue is a panic-time hang condition, not a documented remote attack path. Exploitation would depend on causing or reaching a kernel panic while the relevant device-tree lock state exists; the sources do not provide a practical exploitation scenario.
Researcher notes
The CVE record does not provide CVSS, CWE, or exploit evidence. The vulnerability is narrowly described as a deadlock/hang risk in the PowerPC RTAS panic path. Analysis should focus on architecture, kernel lineage, and whether the referenced stable commits are present in downstream kernels.
Mitigation direction
- Update affected Linux kernels to versions containing the referenced stable commits.
- Prioritize PowerPC systems where panic handling and automatic recovery are operationally important.
- Check distribution or hardware vendor advisories for packaged kernel fix availability.
- If immediate patching is unavailable, document residual crash-recovery risk for affected PowerPC hosts.
Validation and detection
- Inventory Linux hosts running on PowerPC hardware.
- Record kernel versions and distribution kernel package build identifiers.
- Compare installed kernels against vendor advisories and referenced stable commits.
- Review kernel changelogs for the rtas_os_term device-tree lookup fix.
- Confirm patched systems rebooted into the updated kernel.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2022-50870 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/e23822c7381c59d9e42e65771b6e17c71ed30ea7CVE reference
- https://git.kernel.org/stable/c/06a07fbb32b3a23eec20a42b1e64474da0a3b33eCVE reference
- https://git.kernel.org/stable/c/c2fa91abf22a705cf02f886cd99cff41f4ceda60CVE reference
- https://git.kernel.org/stable/c/f2167f10fcca68ab9ae3f8d94d2c704c5541ac69CVE reference
- https://git.kernel.org/stable/c/d8939315b7342860df143afe0adda6212cdd3193CVE reference
- https://git.kernel.org/stable/c/698e682c849e356fb47a8be47ca8baa817cf31e0CVE reference
- https://git.kernel.org/stable/c/464d10e8d797454e16a173ef1292a446b2adf21cCVE reference
- https://git.kernel.org/stable/c/ed2213bfb192ab51f09f12e9b49b5d482c6493f3CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.