Bug 2373539 (CVE-2022-50087) - CVE-2022-50087 kernel: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
Summary: CVE-2022-50087 kernel: firmware: arm_scpi: Ensure scpi_info is not assigned i...
Keywords:
Status: NEW
Alias: CVE-2022-50087
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-06-18 12:07 UTC by OSIDB Bzimport
Modified: 2025-09-29 12:10 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:16919 0 None None None 2025-09-29 12:10:05 UTC
Red Hat Product Errata RHSA-2025:16920 0 None None None 2025-09-29 10:19:09 UTC

Description OSIDB Bzimport 2025-06-18 12:07:24 UTC
In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails

When scpi probe fails, at any point, we need to ensure that the scpi_info
is not set and will remain NULL until the probe succeeds. If it is not
taken care, then it could result use-after-free as the value is exported
via get_scpi_ops() and could refer to a memory allocated via devm_kzalloc()
but freed when the probe fails.

Comment 1 Avinash Hanwate 2025-06-19 15:39:00 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025061859-CVE-2022-50087-53b1@gregkh/T

Comment 6 errata-xmlrpc 2025-09-29 10:19:07 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:16920 https://access.redhat.com/errata/RHSA-2025:16920

Comment 7 errata-xmlrpc 2025-09-29 12:10:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:16919 https://access.redhat.com/errata/RHSA-2025:16919


Note You need to log in before you can comment on or make changes to this bug.