Memory Leak Vulnerability in Linux Kernel - CVE-2022-49534
Summary
CVE-2022-49534: In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT There is a potential memory leak in lpfc_ignore_els_cmpl() and lpfc_els_rsp_reject() th... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It supports a wide range of functionalities, including process management, memory management, and device control. The kernel is crucial for system stability and performance, making it a prime target for vulnerabilities that can lead to system malfunctions or security breaches.
Vulnerability Detail
CVE-2022-49534 is a memory leak vulnerability found in the Linux kernel, specifically within the lpfc driver for Fibre Channel. The issue arises in the functions lpfc_ignore_els_cmpl() and lpfc_els_rsp_reject(), where memory allocated for NPIV PLOGI_RJT is not properly freed. This can lead to excessive memory consumption, potentially causing system instability or crashes. The vulnerability is particularly concerning for systems that rely on NPIV (N-Port ID Virtualization) for managing multiple virtual ports, as it can degrade performance over time.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
CVE-2022-49534 is a significant memory leak vulnerability in the Linux kernel that requires immediate attention. Users are advised to update their systems to the latest patched version to prevent potential exploitation. Monitoring tools like Vulert can help keep your software secure by alerting you to vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49534 is a memory leak vulnerability in the Linux kernel that affects the lpfc driver, potentially leading to system instability.
If exploited, this vulnerability can cause excessive memory usage, leading to performance degradation and possible system crashes.
Yes, a patch is available in the form of updated Linux kernel packages. Users should update to version 5.18.5-1 or later.
While there are no specific workarounds, it is crucial to prioritize applying the patch as soon as possible to mitigate risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json. You can check your application against this vulnerability using the Vulert playground without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
