CVE-2022-50080: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-50080 is an integer overflow vulnerability in the Linux kernel's TEE (Trusted Execution Environment) subsystem, specifically within the register_shm_helper() function. When a low-privileged local user supplies specially crafted memory region lengths via user space, the function miscalculates the number of pages covered, leading to a NULL pointer dereference in internal_get_user_pages_fast() (a helper of pin_user_pages_fast()). The vulnerability affects Linux kernel versions 4.16–4.19.256, 4.20–5.4.211, 5.5–5.10.137, 5.11–5.15.62, 5.16–5.18.19, 5.19–5.19.3, and 6.0-rc1. It was published on June 18, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Feedly).

The root cause is an integer overflow (CWE-476: NULL Pointer Dereference, triggered by the overflow) in register_shm_helper() when computing the page count for a user-supplied memory region length. When an attacker provides a specially crafted length value, the arithmetic overflows, causing pin_user_pages_fast() to receive an invalid page count and subsequently dereference a NULL pointer at virtual address 0x0000000000000010. The fix adds an explicit access_ok() call in tee_shm_register_user_buf() to validate the user space address before proceeding, catching invalid inputs early. Exploitation requires local access with low privileges and the ability to invoke the TEE ioctl interface (e.g., via a TEE client application such as optee_example_a) (Feedly, Kernel Patch).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a system crash (kernel panic) and denial of service. There is no impact on confidentiality or integrity — only availability is affected. The vulnerability is locally scoped with no potential for remote exploitation or lateral movement, but a crash of the kernel affects all processes and users on the system (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local, low-privileged access and interaction with the TEE subsystem, limiting the practical attack surface.

1. Gain local access: Obtain a low-privileged local user account on a system running a vulnerable Linux kernel version (4.16–5.19.2 or 6.0-rc1) with the OP-TEE TEE driver loaded.
2. Identify TEE device: Confirm the TEE device node (e.g., /dev/tee0) is accessible to the unprivileged user.
3. Craft malicious ioctl call: Write or use a TEE client application (similar to optee_example_a) to invoke the tee_ioctl() system call with a TEE_IOC_SHM_REGISTER command, supplying a specially crafted memory region length designed to trigger an integer overflow in register_shm_helper().
4. Trigger overflow: The crafted length causes register_shm_helper() to miscalculate the page count, passing an invalid value to pin_user_pages_fast() → internal_get_user_pages_fast().
5. Kernel crash: internal_get_user_pages_fast() dereferences a NULL pointer at address 0x0000000000000010, causing a kernel panic and system crash (denial of service) (Feedly).

• Logs: Kernel oops/panic messages referencing internal_get_user_pages_fast+0x474/0xa80, pin_user_pages_fast, register_shm_helper, tee_shm_register_user_buf, or tee_ioctl in /var/log/kern.log or dmesg output.
• Logs: Kernel message: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010.
• Process: Unusual or repeated invocations of TEE client processes (e.g., optee_example_a) by low-privileged users, especially if followed by system instability.
• System: Unexpected system reboots or kernel panics on systems with the TEE/OP-TEE driver loaded (Feedly).

Apply the upstream kernel patches available for all affected stable branches. Fixed versions include: 4.19.256, 5.4.211, 5.10.137, 5.15.62, 5.18.19, and 5.19.3. Seven patch commits have been applied to the Linux kernel stable tree (Kernel Patch, Kernel Patch). As a workaround where patching is not immediately possible, restrict unprivileged user access to the TEE device node (e.g., /dev/tee0) using file permissions or access control policies to limit exposure.