CVE-2022-50062

一、漏洞信息
 漏洞编号：[CVE-2022-50062](https://nvd.nist.gov/vuln/detail/CVE-2022-50062)
 漏洞归属组件：[kernel](https://gitee.com/src-openeuler/kernel)
 漏洞归属的版本：4.19.140,4.19.194,4.19.90,5.10.0
 CVSS V3.0分值：
  BaseScore：N/A None
  Vector：CVSS：3.0/
 漏洞简述：
  In the Linux kernel, the following vulnerability has been resolved:net: bgmac: Fix a BUG triggered by wrong bytes_complOn one of our machines we got:kernel BUG at lib/dynamic_queue_limits.c:27!Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARMCPU: 0 PID: 1166 Comm: irq/41-bgmac Tainted: G        W  O    4.14.275-rt132 #1Hardware name: BRCM XGS iProctask: ee3415c0 task.stack: ee32a000PC is at dql_completed+0x168/0x178LR is at bgmac_poll+0x18c/0x6d8pc : [<c03b9430>]    lr : [<c04b5a18>]    psr: 800a0313sp : ee32be14  ip : 000005ea  fp : 00000bd4r10: ee558500  r9 : c0116298  r8 : 00000002r7 : 00000000  r6 : ef128810  r5 : 01993267  r4 : 01993851r3 : ee558000  r2 : 000070e1  r1 : 00000bd4  r0 : ee52c180Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment noneControl: 12c5387d  Table: 8e88c04a  DAC: 00000051Process irq/41-bgmac (pid: 1166, stack limit = 0xee32a210)Stack: (0xee32be14 to 0xee32c000)be00:                                              ee558520 ee52c100 ef128810be20: 00000000 00000002 c0116298 c04b5a18 00000000 c0a0c8c4 c0951780 00000040be40: c0701780 ee558500 ee55d520 ef05b340 ef6f9780 ee558520 00000001 00000040be60: ffffe000 c0a56878 ef6fa040 c0952040 0000012c c0528744 ef6f97b0 fffcfb6abe80: c0a04104 2eda8000 c0a0c4ec c0a0d368 ee32bf44 c0153534 ee32be98 ee32be98bea0: ee32bea0 ee32bea0 ee32bea8 ee32bea8 00000000 c01462e4 ffffe000 ef6f22a8bec0: ffffe000 00000008 ee32bee4 c0147430 ffffe000 c094a2a8 00000003 ffffe000bee0: c0a54528 00208040 0000000c c0a0c8c4 c0a65980 c0124d3c 00000008 ee558520bf00: c094a23c c0a02080 00000000 c07a9910 ef136970 ef136970 ee30a440 ef136900bf20: ee30a440 00000001 ef136900 ee30a440 c016d990 00000000 c0108db0 c012500cbf40: ef136900 c016da14 ee30a464 ffffe000 00000001 c016dd14 00000000 c016db28bf60: ffffe000 ee21a080 ee30a400 00000000 ee32a000 ee30a440 c016dbfc ee25fd70bf80: ee21a09c c013edcc ee32a000 ee30a400 c013ec7c 00000000 00000000 00000000bfa0: 00000000 00000000 00000000 c0108470 00000000 00000000 00000000 00000000bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000[<c03b9430>] (dql_completed) from [<c04b5a18>] (bgmac_poll+0x18c/0x6d8)[<c04b5a18>] (bgmac_poll) from [<c0528744>] (net_rx_action+0x1c4/0x494)[<c0528744>] (net_rx_action) from [<c0124d3c>] (do_current_softirqs+0x1ec/0x43c)[<c0124d3c>] (do_current_softirqs) from [<c012500c>] (__local_bh_enable+0x80/0x98)[<c012500c>] (__local_bh_enable) from [<c016da14>] (irq_forced_thread_fn+0x84/0x98)[<c016da14>] (irq_forced_thread_fn) from [<c016dd14>] (irq_thread+0x118/0x1c0)[<c016dd14>] (irq_thread) from [<c013edcc>] (kthread+0x150/0x158)[<c013edcc>] (kthread) from [<c0108470>] (ret_from_fork+0x14/0x24)Code: a83f15e0 0200001a 0630a0e1 c3ffffea (f201f0e7)The issue seems similar to commit 90b3b339364c ( net: hisilicon: Fix a BUGtrigered by wrong bytes_compl ) and potentially introduced by commitb38c83dd0866 ( bgmac: simplify tx ring index handling ).If there is an RX interrupt between setting ring->endand netdev_sent_queue() we can hit the BUG_ON as bgmac_dma_tx_free()can miscalculate the queue size while called from bgmac_poll().The machine which triggered the BUG runs a v4.14 RT kernel - but the issueseems present in mainline too.
 漏洞公开时间：2025-06-18 19:15:34
 漏洞创建时间：2025-06-19 11:19:09
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-50062
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
|  | https://git.kernel.org/stable/c/1b7680c6c1f6de9904f1d9b05c952f0c64a03350 |  |
|  | https://git.kernel.org/stable/c/ab2b55bb25db289ba0b68e3d58494476bdb1041d |  |
|  | https://git.kernel.org/stable/c/ac6d4482f29ab992b605c1b4bd1347f1f679f4e4 |  |
|  | https://git.kernel.org/stable/c/c506c9a97120f43257e9b3ce7b1f9a24eafc3787 |  |
|  | https://git.kernel.org/stable/c/da1421a29d3b8681ba6a7f686bd0b40dda5acaf3 |  |
|  | https://www.cve.org/CVERecord?id=CVE-2022-50062 |  |
|  | https://nvd.nist.gov/vuln/detail/CVE-2022-50062 |  |
|  | https://lore.kernel.org/linux-cve-announce/2025061850-CVE-2022-50062-13da@gregkh/T |  |
|  | https://bugzilla.redhat.com/show_bug.cgi?id=2373578 |  |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  七彩瞬析开源风险感知平台
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
| gregkh/linux |  | https://github.com/gregkh/linux/commit/1b7680c6c1f6de9904f1d9b05c952f0c64a03350.patch |  | ljqc |
|  |  | https://git.kernel.org/stable/c/1b7680c6c1f6de9904f1d9b05c952f0c64a03350 |  | nvd |
|  |  | https://git.kernel.org/stable/c/ab2b55bb25db289ba0b68e3d58494476bdb1041d |  | nvd |
|  |  | https://git.kernel.org/stable/c/ac6d4482f29ab992b605c1b4bd1347f1f679f4e4 |  | nvd |
|  |  | https://git.kernel.org/stable/c/c506c9a97120f43257e9b3ce7b1f9a24eafc3787 |  | nvd |
|  |  | https://git.kernel.org/stable/c/da1421a29d3b8681ba6a7f686bd0b40dda5acaf3 |  | nvd |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In the Linux kernel, the following vulnerability has been resolved:net: bgmac: Fix a BUG triggered by wrong bytes_complOn one of our machines we got:kernel BUG at lib/dynamic_queue_limits.c:27!Internal error: Oops - BUG: 0 [#1] PREEMPT SMP ARMCPU: 0 PID: 1166 Comm: irq/41-bgmac Tainted: G        W  O    4.14.275-rt132 #1Hardware name: BRCM XGS iProctask: ee3415c0 task.stack: ee32a000PC is at dql_completed+0x168/0x178LR is at bgmac_poll+0x18c/0x6d8pc : [&lt;c03b9430&gt;]    lr : [&lt;c04b5a18&gt;]    psr: 800a0313sp : ee32be14  ip : 000005ea  fp : 00000bd4r10: ee558500  r9 : c0116298  r8 : 00000002r7 : 00000000  r6 : ef128810  r5 : 01993267  r4 : 01993851r3 : ee558000  r2 : 000070e1  r1 : 00000bd4  r0 : ee52c180Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment noneControl: 12c5387d  Table: 8e88c04a  DAC: 00000051Process irq/41-bgmac (pid: 1166, stack limit = 0xee32a210)Stack: (0xee32be14 to 0xee32c000)be00:                                              ee558520 ee52c100 ef128810be20: 00000000 00000002 c0116298 c04b5a18 00000000 c0a0c8c4 c0951780 00000040be40: c0701780 ee558500 ee55d520 ef05b340 ef6f9780 ee558520 00000001 00000040be60: ffffe000 c0a56878 ef6fa040 c0952040 0000012c c0528744 ef6f97b0 fffcfb6abe80: c0a04104 2eda8000 c0a0c4ec c0a0d368 ee32bf44 c0153534 ee32be98 ee32be98bea0: ee32bea0 ee32bea0 ee32bea8 ee32bea8 00000000 c01462e4 ffffe000 ef6f22a8bec0: ffffe000 00000008 ee32bee4 c0147430 ffffe000 c094a2a8 00000003 ffffe000bee0: c0a54528 00208040 0000000c c0a0c8c4 c0a65980 c0124d3c 00000008 ee558520bf00: c094a23c c0a02080 00000000 c07a9910 ef136970 ef136970 ee30a440 ef136900bf20: ee30a440 00000001 ef136900 ee30a440 c016d990 00000000 c0108db0 c012500cbf40: ef136900 c016da14 ee30a464 ffffe000 00000001 c016dd14 00000000 c016db28bf60: ffffe000 ee21a080 ee30a400 00000000 ee32a000 ee30a440 c016dbfc ee25fd70bf80: ee21a09c c013edcc ee32a000 ee30a400 c013ec7c 00000000 00000000 00000000bfa0: 00000000 00000000 00000000 c0108470 00000000 00000000 00000000 00000000bfc0: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000bfe0: 00000000 00000000 00000000 00000000 00000013 00000000 00000000 00000000[&lt;c03b9430&gt;] (dql_completed) from [&lt;c04b5a18&gt;] (bgmac_poll+0x18c/0x6d8)[&lt;c04b5a18&gt;] (bgmac_poll) from [&lt;c0528744&gt;] (net_rx_action+0x1c4/0x494)[&lt;c0528744&gt;] (net_rx_action) from [&lt;c0124d3c&gt;] (do_current_softirqs+0x1ec/0x43c)[&lt;c0124d3c&gt;] (do_current_softirqs) from [&lt;c012500c&gt;] (__local_bh_enable+0x80/0x98)[&lt;c012500c&gt;] (__local_bh_enable) from [&lt;c016da14&gt;] (irq_forced_thread_fn+0x84/0x98)[&lt;c016da14&gt;] (irq_forced_thread_fn) from [&lt;c016dd14&gt;] (irq_thread+0x118/0x1c0)[&lt;c016dd14&gt;] (irq_thread) from [&lt;c013edcc&gt;] (kthread+0x150/0x158)[&lt;c013edcc&gt;] (kthread) from [&lt;c0108470&gt;] (ret_from_fork+0x14/0x24)Code: a83f15e0 0200001a 0630a0e1 c3ffffea (f201f0e7)The issue seems similar to commit 90b3b339364c (&#34;net: hisilicon: Fix a BUGtrigered by wrong bytes_compl&#34;) and potentially introduced by commitb38c83dd0866 (&#34;bgmac: simplify tx ring index handling&#34;).If there is an RX interrupt between setting ring-&gt;endand netdev_sent_queue() we can hit the BUG_ON as bgmac_dma_tx_free()can miscalculate the queue size while called from bgmac_poll().The machine which triggered the BUG runs a v4.14 RT kernel - but the issueseems present in mainline too.The Linux kernel CVE team has assigned CVE-2022-50062 to this issue.
 openEuler评分：
  5.5
 Vector：CVSS：3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 受影响版本排查(受影响/不受影响)：
  1.master(6.12.33):不受影响
2.openEuler-20.03-LTS-SP4(4.19.90):不受影响
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响
5.openEuler-24.03-LTS(6.6.0):不受影响
6.openEuler-24.03-LTS-Next(6.6.0):不受影响
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响

修复是否涉及abi变化(是/否)：
  1.master(6.12.33):否
2.openEuler-20.03-LTS-SP4(4.19.90):否
3.openEuler-22.03-LTS-SP3(5.10.0):否
4.openEuler-22.03-LTS-SP4(5.10.0):否
5.openEuler-24.03-LTS(6.6.0):否
6.openEuler-24.03-LTS-Next(6.6.0):否
7.openEuler-24.03-LTS-SP1(6.6.0):否
8.openEuler-24.03-LTS-SP2(6.6.0):否

原因说明：
  1.openEuler-20.03-LTS-SP4(4.19.90):不受影响-组件不存在
2.master(6.12.33):不受影响-漏洞代码不能被攻击者触发
3.openEuler-22.03-LTS-SP3(5.10.0):不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP4(5.10.0):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS(6.6.0):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next(6.6.0):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1(6.6.0):不受影响-漏洞代码不能被攻击者触发
8.openEuler-24.03-LTS-SP2(6.6.0):不受影响-漏洞代码不能被攻击者触发

src-openEuler/kernel

内容风险标识

评论 (5)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2022-50062

评论 (5)

搜索帮助

src-openEuler/kernel