Memory Leak Vulnerability in Linux Kernel - CVE-2022-48975
Summary
CVE-2022-48975: In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiochip_setup_dev() Here is a backtrace report about memory leak detected in gpiochip_setup_dev(): unreferenced object 0xff... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It manages system resources, facilitates communication between hardware and software, and ensures system stability. This vulnerability specifically affects the GPIO (General Purpose Input/Output) subsystem, which is crucial for managing input and output operations on various hardware devices. The vulnerability arises from improper resource management during device registration, leading to potential memory leaks.
Vulnerability Detail
In the Linux kernel, a memory leak was identified in the gpiochip_setup_dev() function. When a device is registered using gcdev_register(), the device_add() function is called, which allocates resources that are not properly released by device_del(). This oversight can lead to unreferenced memory objects persisting in the system, consuming resources unnecessarily. Additionally, when the number of GPIOs (gc->ngpio) is zero, the system still attempts to allocate memory, which can lead to further inefficiencies. The vulnerability can result in degraded system performance and increased memory usage over time.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-48975 is a significant memory leak vulnerability in the Linux kernel that can lead to resource exhaustion. It is crucial for users to update their systems to the patched version to ensure optimal performance and security. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2022-48975 is a memory leak vulnerability in the Linux kernel's GPIO subsystem, which can lead to resource exhaustion and degraded system performance.
If your system uses the affected Linux kernel version, it may experience increased memory usage over time, potentially leading to performance issues.
Yes, a patch is available in Linux kernel version 6.1.4-1 and later. It is recommended to update your system to this version or newer.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by CVE-2022-48975 using the Vulert playground without any signup.
While there are no specific workarounds, it is advisable to monitor your system's memory usage and apply the patch as soon as possible to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
