{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2022-50171", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-06-18T10:57:27.426Z", "datePublished": "2025-06-18T11:03:23.710Z", "dateUpdated": "2026-08-05T08:57:38.553Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:57:38.553Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/sec - don't sleep when in softirq\n\nWhen kunpeng920 encryption driver is used to deencrypt and decrypt\npackets during the softirq, it is not allowed to use mutex lock. The\nkernel will report the following error:\n\nBUG: scheduling while atomic: swapper/57/0/0x00000300\nCall trace:\ndump_backtrace+0x0/0x1e4\nshow_stack+0x20/0x2c\ndump_stack+0xd8/0x140\n__schedule_bug+0x68/0x80\n__schedule+0x728/0x840\nschedule+0x50/0xe0\nschedule_preempt_disabled+0x18/0x24\n__mutex_lock.constprop.0+0x594/0x5dc\n__mutex_lock_slowpath+0x1c/0x30\nmutex_lock+0x50/0x60\nsec_request_init+0x8c/0x1a0 [hisi_sec2]\nsec_process+0x28/0x1ac [hisi_sec2]\nsec_skcipher_crypto+0xf4/0x1d4 [hisi_sec2]\nsec_skcipher_encrypt+0x1c/0x30 [hisi_sec2]\ncrypto_skcipher_encrypt+0x2c/0x40\ncrypto_authenc_encrypt+0xc8/0xfc [authenc]\ncrypto_aead_encrypt+0x2c/0x40\nechainiv_encrypt+0x144/0x1a0 [echainiv]\ncrypto_aead_encrypt+0x2c/0x40\nesp_output_tail+0x348/0x5c0 [esp4]\nesp_output+0x120/0x19c [esp4]\nxfrm_output_one+0x25c/0x4d4\nxfrm_output_resume+0x6c/0x1fc\nxfrm_output+0xac/0x3c0\nxfrm4_output+0x64/0x130\nip_build_and_send_pkt+0x158/0x20c\ntcp_v4_send_synack+0xdc/0x1f0\ntcp_conn_request+0x7d0/0x994\ntcp_v4_conn_request+0x58/0x6c\ntcp_v6_conn_request+0xf0/0x100\ntcp_rcv_state_process+0x1cc/0xd60\ntcp_v4_do_rcv+0x10c/0x250\ntcp_v4_rcv+0xfc4/0x10a4\nip_protocol_deliver_rcu+0xf4/0x200\nip_local_deliver_finish+0x58/0x70\nip_local_deliver+0x68/0x120\nip_sublist_rcv_finish+0x70/0x94\nip_list_rcv_finish.constprop.0+0x17c/0x1d0\nip_sublist_rcv+0x40/0xb0\nip_list_rcv+0x140/0x1dc\n__netif_receive_skb_list_core+0x154/0x28c\n__netif_receive_skb_list+0x120/0x1a0\nnetif_receive_skb_list_internal+0xe4/0x1f0\nnapi_complete_done+0x70/0x1f0\ngro_cell_poll+0x9c/0xb0\nnapi_poll+0xcc/0x264\nnet_rx_action+0xd4/0x21c\n__do_softirq+0x130/0x358\nirq_exit+0x11c/0x13c\n__handle_domain_irq+0x88/0xf0\ngic_handle_irq+0x78/0x2c0\nel1_irq+0xb8/0x140\narch_cpu_idle+0x18/0x40\ndefault_idle_call+0x5c/0x1c0\ncpuidle_idle_call+0x174/0x1b0\ndo_idle+0xc8/0x160\ncpu_startup_entry+0x30/0x11c\nsecondary_start_kernel+0x158/0x1e4\nsoftirq: huh, entered softirq 3 NET_RX 0000000093774ee4 with\npreempt_count 00000100, exited with fffffe00?" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - The commit's call chain shows a remote TCP SYN (netif_receive → tcp_v4_rcv → tcp_conn_request) causing esp_output → HiSilicon SEC encrypt in softirq; inbound ESP decrypt uses the same mutex-protected sec_process path. On Kunpeng IPsec gateways this is reachable over the network.\nAC:L - An attacker who can send traffic that drives SEC crypto fully controls load and can create req_lock contention across concurrent softirq requests and completions so mutex_lock takes the slowpath; no attacker-uncontrollable race or memory layout is required.\nPR:N - The documented trigger is an unauthenticated TCP SYN whose SYN-ACK is ESP-encrypted under an existing SPD/SA (deployment config, e.g. site-to-site VPN); the attacker need not authenticate to the host or complete IKE on the trigger path.\nUI:N - Packet receive and softirq ESP/crypto run entirely in the network stack; no victim mount, open, or other interactive action is required.\nS:U - Impact is confined to the host kernel's own softirq/preempt state and availability; this is in-kernel DoS, not VM escape, IOMMU bypass, or another cross-boundary impact.\nC:N - The defect is sleeping in atomic context (mutex in softirq) with preempt_count corruption; there is no OOB read, UAF, or other disclosure primitive.\nI:N - There is no memory corruption, write primitive, or control-flow hijack—only an illegal schedule in softirq—so integrity and code execution are not implicated.\nA:H - The bug produces BUG: scheduling while atomic and softirq preempt_count underflow (exited with fffffe00), which can hang or crash the kernel and is High availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/crypto/hisilicon/sec2/sec.h", "drivers/crypto/hisilicon/sec2/sec_crypto.c" ], "versions": [ { "version": "416d82204df44ef727de6eafafeaa4d12fdc78dc", "lessThan": "16e18a8ac7c9748cf35a8d2f0ba2c6e8850e7568", "status": "affected", "versionType": "git" }, { "version": "416d82204df44ef727de6eafafeaa4d12fdc78dc", "lessThan": "aa495dfe71229b9034b59d8072ff0b2325ddd5ee", "status": "affected", "versionType": "git" }, { "version": "416d82204df44ef727de6eafafeaa4d12fdc78dc", "lessThan": "4a461ba5b9753352f438824fdd915cba675b1733", "status": "affected", "versionType": "git" }, { "version": "416d82204df44ef727de6eafafeaa4d12fdc78dc", "lessThan": "c9be45e4c69fde36522274f04d1aa0d097ae3958", "status": "affected", "versionType": "git" }, { "version": "416d82204df44ef727de6eafafeaa4d12fdc78dc", "lessThan": "02884a4f12de11f54d4ca67a07dd1f111d96fdbd", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/crypto/hisilicon/sec2/sec.h", "drivers/crypto/hisilicon/sec2/sec_crypto.c" ], "versions": [ { "version": "5.5", "status": "affected" }, { "version": "0", "lessThan": "5.5", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.137", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.61", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.18.18", "lessThanOrEqual": "5.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.19.2", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.10.137" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.15.61" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.18.18" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.19.2" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "6.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/16e18a8ac7c9748cf35a8d2f0ba2c6e8850e7568" }, { "url": "https://git.kernel.org/stable/c/aa495dfe71229b9034b59d8072ff0b2325ddd5ee" }, { "url": "https://git.kernel.org/stable/c/4a461ba5b9753352f438824fdd915cba675b1733" }, { "url": "https://git.kernel.org/stable/c/c9be45e4c69fde36522274f04d1aa0d097ae3958" }, { "url": "https://git.kernel.org/stable/c/02884a4f12de11f54d4ca67a07dd1f111d96fdbd" } ], "title": "crypto: hisilicon/sec - don't sleep when in softirq", "x_generator": { "engine": "bippy-1.2.0" } } } }