CVE-2022-50081: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-v5qc-r96v-5v88
Share
Published
Advisory Summary

CVE-2022-50081 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2022-50081 at a Glance

CVE Identifier CVE-2022-50081
GHSA Identifier GHSA-v5qc-r96v-5v88
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2022-50081

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2022-50081, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: KVM: Unconditionally get a ref to /dev/kvm module when creating a VM Unconditionally get a reference to the /dev/kvm module when creating a VM instead of using try_get_module(), which will fail if the module is in the process of being forcefully unloaded. The error handling when try_get_module() fails doesn't properly unwind all that has been done, e.g. doesn't call kvm_arch_pre_destroy_vm() and doesn't remove the VM from the global list. Not removing VMs from the global list tends to be fatal, e.g. leads to use-after-free explosions. The obvious alternative would be to add proper unwinding, but the justification for using try_get_module(), "rmmod --wait", is completely bogus as support for "rmmod --wait", i.e. delete_module() without O_NONBLOCK, was removed by commit 3f2b9c9cdf38 ("module: remove rmmod --wait option.") nearly a decade ago. It's still possible for try_get_module() to fail due to the module dying (more like being killed), as the module will be tagged MODULE_STATE_GOING by "rmmod --force", i.e. delete_module(..., O_TRUNC), but playing nice with forced unloading is an exercise in futility and gives a falsea sense of security. Using try_get_module() only prevents acquiring _new_ references, it doesn't magically put the references held by other VMs, and forced unloading doesn't wait, i.e. "rmmod --force" on KVM is all but guaranteed to cause spectacular fireworks; the window where KVM will fail try_get_module() is tiny compared to the window where KVM is building and running the VM with an elevated module refcount. Addressing KVM's inability to play nice with "rmmod --force" is firmly out-of-scope. Forcefully unloading any module taints kernel (for obvious reasons) _and_ requires the kernel to be built with CONFIG_MODULE_FORCE_UNLOAD=y, which is off by default and comes with the amusing disclaimer that it's "mainly for kernel developers and desperate users". In other words, KVM is free to scoff at bug reports due to using "rmmod --force" while VMs may be running.

References

NVD — CVE-2022-50081 NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-50081
git.kernel.org/stable/c/177bf35420... WEB
https://git.kernel.org/stable/c/177bf354200962c6f0de6dd37c86a9bf3b54003a
git.kernel.org/stable/c/405294f29f... WEB
https://git.kernel.org/stable/c/405294f29faee5de8c10cb9d4a90e229c2835279
git.kernel.org/stable/c/865e08b77c... WEB
https://git.kernel.org/stable/c/865e08b77c244eed0b80439320e7e8440f61ebce

Frequently Asked Questions

What is CVE-2022-50081?
CVE-2022-50081 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2022-50081?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2022-50081?
CVE-2022-50081 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2022-50081?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-v5qc-r96v-5v88",
  "modified" : "2025-06-18T12:30:47Z",
  "published" : "2025-06-18T12:30:46Z",
  "aliases" : [ "CVE-2022-50081" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nKVM: Unconditionally get a ref to /dev/kvm module when creating a VM\n\nUnconditionally get a reference to the /dev/kvm module when creating a VM\ninstead of using try_get_module(), which will fail if the module is in\nthe process of being forcefully unloaded.  The error handling when\ntry_get_module() fails doesn't properly unwind all that has been done,\ne.g. doesn't call kvm_arch_pre_destroy_vm() and doesn't remove the VM\nfrom the global list.  Not removing VMs from the global list tends to be\nfatal, e.g. leads to use-after-free explosions.\n\nThe obvious alternative would be to add proper unwinding, but the\njustification for using try_get_module(), \"rmmod --wait\", is completely\nbogus as support for \"rmmod --wait\", i.e. delete_module() without\nO_NONBLOCK, was removed by commit 3f2b9c9cdf38 (\"module: remove rmmod\n--wait option.\") nearly a decade ago.\n\nIt's still possible for try_get_module() to fail due to the module dying\n(more like being killed), as the module will be tagged MODULE_STATE_GOING\nby \"rmmod --force\", i.e. delete_module(..., O_TRUNC), but playing nice\nwith forced unloading is an exercise in futility and gives a falsea sense\nof security.  Using try_get_module() only prevents acquiring _new_\nreferences, it doesn't magically put the references held by other VMs,\nand forced unloading doesn't wait, i.e. \"rmmod --force\" on KVM is all but\nguaranteed to cause spectacular fireworks; the window where KVM will fail\ntry_get_module() is tiny compared to the window where KVM is building and\nrunning the VM with an elevated module refcount.\n\nAddressing KVM's inability to play nice with \"rmmod --force\" is firmly\nout-of-scope.  Forcefully unloading any module taints kernel (for obvious\nreasons)  _and_ requires the kernel to be built with\nCONFIG_MODULE_FORCE_UNLOAD=y, which is off by default and comes with the\namusing disclaimer that it's \"mainly for kernel developers and desperate\nusers\".  In other words, KVM is free to scoff at bug reports due to using\n\"rmmod --force\" while VMs may be running.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2022-50081"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/177bf354200962c6f0de6dd37c86a9bf3b54003a"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/405294f29faee5de8c10cb9d4a90e229c2835279"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/865e08b77c244eed0b80439320e7e8440f61ebce"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2025-06-18T11:15:37Z"
  }
}