CVE-2022-50366
📋 TL;DR
This CVE is a Linux kernel vulnerability in the Intel RAPL power capping subsystem where improper input validation leads to an undefined behavior shift operation. Attackers with local access could trigger a kernel panic or potentially execute arbitrary code. Affects systems running vulnerable Linux kernel versions with Intel processors supporting RAPL.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Local privilege escalation to kernel-level code execution leading to complete system compromise
Likely Case
Kernel panic causing denial of service (system crash)
If Mitigated
No impact if patched or workaround applied
🎯 Exploit Status
Exploitation requires write access to /sys/class/powercap/intel-rapl/*/constraint_*_time_window_us files
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Patched in stable kernel versions via commits referenced in CVE
Vendor Advisory: https://git.kernel.org/stable/c/139bbbd01114433b80fe59f5e1330615aadf9752
Restart Required: Yes
Instructions:
1. Update Linux kernel to patched version from distribution vendor. 2. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable RAPL sysfs interface
linuxRemove write permissions from RAPL constraint time window files
chmod a-w /sys/class/powercap/intel-rapl/*/constraint_*_time_window_us
🧯 If You Can't Patch
- Apply workaround to restrict write access to RAPL sysfs files
- Implement strict access controls to prevent unauthorized local users from accessing power management interfaces
🔍 How to Verify
Check if Vulnerable:
Check kernel version and verify if RAPL sysfs interface exists: ls -la /sys/class/powercap/intel-rapl/Check Version:
uname -rVerify Fix Applied:
Verify kernel version is updated to patched version and test that writing invalid values to constraint time window files doesn't crash system📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs mentioning 'shift exponent too large' or 'UBSAN shift-out-of-bounds'
- System crash/reboot events
Network Indicators:
- No network indicators - local exploit only
SIEM Query:
Search for kernel panic events or system crashes with powercap/rapl related context🔗 References
- https://git.kernel.org/stable/c/139bbbd01114433b80fe59f5e1330615aadf9752
- https://git.kernel.org/stable/c/1d94af37565e4d3c26b0d63428e093a37d5b4c32
- https://git.kernel.org/stable/c/2d93540014387d1c73b9ccc4d7895320df66d01b
- https://git.kernel.org/stable/c/3eb0ba70376f6ee40fa843fc9cee49269370b0b3
- https://git.kernel.org/stable/c/42f79dbb9514f726ff21df25f09cb0693b0b2445
- https://git.kernel.org/stable/c/49a6ffdaed60f0eb52c198fafebc05994e16e305
- https://git.kernel.org/stable/c/4ebba43384722adbd325baec3a12c572d94488eb
- https://git.kernel.org/stable/c/6216b685b8f48ab7b721a6fd5acbf526b41c13e8
- https://git.kernel.org/stable/c/708b9abe1b4a2f050a483db4b7edfc446b13df1f
