Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2022-50052: Linux kernel may overwrite memory with snprintf

CVE-2022-50052 · published 1 year ago

Summary

A part of the Linux kernel’s audio driver could write more data than the space that was set aside, potentially causing a crash or other unexpected behavior. The issue is unlikely to be triggered in normal use, and a patch has replaced the risky function with a safer one. Update your Linux kernel to the latest version to apply the fix.

What to do

Update debian linux to version 6.0.2-1.
Update linux kernel to version 5.19.4.
Update linux linux_kernel to version 5.19.4 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	linux	linux_kernel	>= 5.19, < 5.19.4 6.0 `cpe:2.3:o:linux:linux_kernel::::::::`
Debian:12	debian	linux	< 6.0.2-1 Fix: upgrade to 6.0.2-1
Linux	linux	kernel	>= 5.19.0, < 5.19.4 Fix: upgrade to 5.19.4

Original advisory text

ASoC: Intel: avs: Fix potential buffer overflow by snprintf()

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix potential buffer overflow by snprintf() snprintf() returns the would-be-filled size when the string overflows the given buffer size, hence using this value may result in a buffer overflow (although it's unrealistic). This patch replaces it with a safer version, scnprintf() for papering over such a potential issue.

References

https://git.kernel.org/stable/c/840311a09f75632b9d41fbc1cd5c7aea94ce5f7e URL
https://git.kernel.org/stable/c/ca3b7b9dc9bc1fa552f4697b7cccfa0258a44d00 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/50xxx/CVE-2022-50052... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-50052 Vendor Advisory
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git Product
https://security-tracker.debian.org/tracker/CVE-2022-50052 Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-787Out-of-bounds Write

Timeline

Published18 Jun 2025

Updated29 Oct 2026

First seen7 Mar 2026

Sources

CVE-2022-50052 · NVD

CVE-2022-50052 · OSV

DEBIAN-CVE-2022-50052 · OSV

Track software like this

Free during beta