Refcount Leak Vulnerability in Linux Kernel: CVE-2022-49310
Summary
CVE-2022-49310: In the Linux kernel, the following vulnerability has been resolved: char: xillybus: fix a refcount leak in cleanup_dev() usb_get_dev is called in xillyusb_probe. Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its robustness, flexibility, and extensive support for various hardware architectures. However, like any complex software, it is susceptible to vulnerabilities. CVE-2022-49310 specifically affects the xillybus character driver, which is used for interfacing with Xillybus hardware. This vulnerability can lead to resource leaks, potentially affecting system stability and performance.
Vulnerability Detail
CVE-2022-49310 is a refcount leak vulnerability found in the cleanup_dev() function of the xillybus driver in the Linux kernel. The issue arises when usb_get_dev is called in the xillyusb_probe function without a corresponding usb_put_dev call before releasing the xdev resource. This oversight can lead to a situation where the reference count of the USB device is not decremented properly, causing memory leaks and potentially exhausting system resources. If exploited, this vulnerability could lead to degraded system performance or crashes.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux kernel as described in the 'how_to_fix' section.
Conclusion
CVE-2022-49310 is a significant vulnerability in the Linux kernel that can lead to resource leaks and system instability. Users are strongly advised to update their Linux kernel to the patched version to ensure system security and performance. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49310 is a vulnerability in the Linux kernel's xillybus driver that leads to a refcount leak, potentially causing memory leaks and system instability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by CVE-2022-49310.
The vulnerability can lead to memory leaks, which may degrade system performance, cause crashes, or exhaust system resources over time.
Yes, a patch is available in the form of an updated Linux kernel version (5.18.5-1 or later) that addresses this vulnerability.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
