Memory Leak Vulnerability in Linux Kernel's MDIO Device Management
Summary
CVE-2022-48961: In the Linux kernel, the following vulnerability has been resolved: net: mdio: fix unbalanced fwnode reference count in mdio_device_release() There is warning report about of_node refcount leak while probing mdio device:... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system operations. It supports a wide range of devices and functionalities, including network interfaces through the MDIO (Management Data Input/Output) subsystem. This subsystem is crucial for managing Ethernet PHY devices, enabling communication between the kernel and network hardware. However, a recent vulnerability has been identified that affects the reference counting mechanism in MDIO device management, potentially leading to memory leaks and system instability.
Vulnerability Detail
The vulnerability arises from an unbalanced reference count in the function mdio_device_release() within the Linux kernel. Specifically, when probing an MDIO device, the function of_mdiobus_register_device() increases the fwnode reference count using fwnode_handle_get() but fails to decrease it in the normal execution path. This oversight results in a memory leak, as indicated by the warning report stating that the expected reference count was not maintained. If exploited, this vulnerability could lead to increased memory usage and eventual system crashes due to resource exhaustion.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-48961 is a significant vulnerability in the Linux kernel's MDIO device management that can lead to memory leaks and system instability. Users are strongly advised to update their systems to the patched versions to mitigate the risks associated with this vulnerability. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The impact includes potential memory leaks that can lead to increased memory usage and system instability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
The vulnerability affects Linux versions in Debian 11, 12, and 13, specifically before the patch version 6.1.4-1.
While the vulnerability is primarily a memory leak, it could lead to denial of service if not addressed, making it important to apply the patch.
If immediate updates are not possible, monitor your system's memory usage closely and consider limiting the use of affected network devices until the patch can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
