# CVE-2022-50450: linux: In the Linux kernel, the following vulnerability has been resolved:  libbpf: Use elf_getshdrnum() instead of e_shnum...

CVE-2022-50450 is fixed in linux on 1 platform, first by DEBIAN-CVE-2022-50450, released October 1, 2025. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2022-50450
- Priority: Routine
- CVSS: n/a
- EPSS: n/a
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 1, 2025

## Description

In the Linux kernel, the following vulnerability has been resolved:  libbpf: Use elf_getshdrnum() instead of e_shnum  This commit replace e_shnum with the elf_getshdrnum() helper to fix two oss-fuzz-reported heap-buffer overflow in __bpf_object__open. Both reports are incorrectly marked as fixed and while still being reproducible in the latest libbpf.    # clusterfuzz-testcase-minimized-bpf-object-fuzzer-5747922482888704   libbpf: loading object 'fuzz-object' from buffer   libbpf: sec_cnt is 0   libbpf: elf: section(1) .data, size 0, link 538976288, flags 2020202020202020, type=2   libbpf: elf: section(2) .data, size 32, link 538976288, flags 202020202020ff20, type=1   =================================================================   ==13==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000000c0 at pc 0x0000005a7b46 bp 0x7ffd12214af0 sp 0x7ffd12214ae8   WRITE of size 4 at 0x6020000000c0 thread T0   SCARINESS: 46 (4-byte-write-heap-buffer-overflow-far-from-bounds)       #0 0x5a7b45 in bpf_object__elf_collect /src/libbpf/src/libbpf.c:3414:24       #1 0x5733c0 in bpf_object_open /src/libbpf/src/libbpf.c:7223:16       #2 0x5739fd in bpf_object__open_mem /src/libbpf/src/libbpf.c:7263:20       ...  The issue lie in libbpf's direct use of e_shnum field in ELF header as the section header count. Where as libelf implemented an extra logic that, when e_shnum == 0 && e_shoff != 0, will use sh_size member of the initial section header as the real section header count (part of ELF spec to accommodate situation where section header counter is larger than SHN_LORESERVE).  The above inconsistency lead to libbpf writing into a zero-entry calloc area. So intead of using e_shnum directly, use the elf_getshdrnum() helper provided by libelf to retrieve the section header counter into sec_cnt.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.4-1 | [DEBIAN-CVE-2022-50450](https://patchblox.com/security/data/fix/linux/debian-cve-2022-50450.md) | Oct 1, 2025 |
| Linux | linux Debian 13.5 (trixie) | 6.1.4-1 | [DEBIAN-CVE-2022-50450](https://patchblox.com/security/data/fix/linux/debian-cve-2022-50450.md) | Oct 1, 2025 |
| Linux | linux Debian 14 | 6.1.4-1 | [DEBIAN-CVE-2022-50450](https://patchblox.com/security/data/fix/linux/debian-cve-2022-50450.md) | Oct 1, 2025 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.