CVE-2022-50756

A flaw was addressed in the Linux kernel’s nvme-pci driver related to how the driver calculated the worst-case number of PRP (Physical Region Page) lists required for a given I/O request. The implementation previously rounded the allocation to one list instead of correctly converting the maximum size into bytes before computing the divisor. Under certain rare conditions (for example, a 4 MiB transfer split across many physical segments on a queue that does not support SGLs), this calculation error could result in memory being corrupted beyond the size provided by the mempool. This memory corruption has been observed using kfence

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because triggering the flaw requires local access and highly unusual I/O transfer conditions that are difficult to induce intentionally. An attacker or unprivileged local user would need to generate a specific large I/O payload across fragmented physical segments on non-SGL NVMe queues to trigger the out-of-bounds memory write. Consequently, the primary operational blast radius is confined to local denial of service via kernel panic or memory corruption rather than arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.