SMB2 Negotiation Memory Leak in Linux Kernel - CVE-2022-49938
Summary
CVE-2022-49938: In the Linux kernel, the following vulnerability has been resolved: cifs: fix small mempool leak in SMB2_negotiate() In some cases of failure (dialect mismatches) in SMB2_negotiate(), after the request is sent, the check... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware, system resources, and provides essential services for software applications. It is widely used across various distributions, including Debian. The kernel is responsible for system stability, performance, and security. This vulnerability specifically affects the SMB2 negotiation process, which is critical for file sharing and network communication.
Vulnerability Detail
CVE-2022-49938 is a vulnerability in the Linux kernel's CIFS (Common Internet File System) implementation. It arises during the SMB2_negotiate() function when there is a dialect mismatch, leading to a failure in handling the response buffer. Instead of properly freeing the memory allocated for the response buffer, the code returns an error code (-EIO) without releasing the memory, resulting in a small memory leak. This could potentially lead to increased memory usage over time, impacting system performance and stability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate the risk.
Conclusion
CVE-2022-49938 is a significant vulnerability in the Linux kernel that can lead to memory leaks during SMB2 negotiations. It is essential to update to the patched version to ensure system stability and performance. Monitoring tools like Vulert can help you stay informed about vulnerabilities affecting your software.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49938 is a vulnerability in the Linux kernel that causes a memory leak during the SMB2 negotiation process.
This vulnerability can lead to increased memory usage, potentially affecting system performance and stability over time.
The vulnerability affects Linux packages in Debian 11, 12, and 13, particularly before the fixed version 5.19.11-1.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to install any software.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
