Timeout Poll Request Leak in Linux Kernel - CVE-2022-49057
Summary
CVE-2022-49057: In the Linux kernel, the following vulnerability has been resolved: block: null_blk: end timed out poll request When poll request is timed out, it is removed from the poll list, but not completed, so the request is leake... Affects linux versions < 5.17.6-1. Fixed in 5.17.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management, process control, and system security. It is widely used across various distributions, including Debian. This vulnerability affects the null_blk block device, which is responsible for handling block I/O requests. The vulnerability arises from a failure to properly manage poll requests that time out, leading to resource leaks.
Vulnerability Detail
CVE-2022-49057 is a vulnerability in the Linux kernel where poll requests that time out are removed from the poll list but are not completed, resulting in leaked requests that never get a chance to complete. This can lead to resource exhaustion and degraded system performance, as the leaked requests consume system resources without being processed.
How To Fix
Minimum fixed version
5.17.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-49057 is a significant vulnerability in the Linux kernel that can lead to resource leaks and performance issues. It is crucial to update to the patched version to mitigate the risks associated with this vulnerability. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49057 is a vulnerability in the Linux kernel that causes poll requests to leak when they time out.
It can lead to resource exhaustion and degraded performance due to unprocessed poll requests consuming system resources.
Yes, the patched version for Debian 12 and 13 is 5.17.6-1. Updating to this version will resolve the issue.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds, it is advisable to monitor your system closely and plan for an update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
