Refcount Leak in GameCube RTC - Linux Package Vulnerability
Summary
CVE-2022-49150: In the Linux kernel, the following vulnerability has been resolved: rtc: gamecube: Fix refcount leak in gamecube_rtc_read_offset_from_sram The of_find_compatible_node() function returns a node pointer with refcount incre... Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services and managing hardware resources. It is known for its stability, performance, and extensive support for various hardware architectures. The kernel is modular, allowing for the addition of features and drivers. However, like any complex software, it is susceptible to vulnerabilities that can affect system security and stability. This specific vulnerability pertains to the GameCube Real-Time Clock (RTC) functionality, which is responsible for maintaining time and date settings in GameCube devices.
Vulnerability Detail
The vulnerability identified as CVE-2022-49150 is a reference count leak in the GameCube RTC driver within the Linux kernel. This issue arises from the improper handling of node pointers returned by the of_find_compatible_node() function, which increments the reference count but fails to decrement it when the node is no longer needed. As a result, this can lead to memory leaks and potentially exhaust system resources, impacting the stability and performance of the kernel. If exploited, this vulnerability could allow an attacker to manipulate the kernel's memory management, leading to denial of service or other malicious activities.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version.
Conclusion
CVE-2022-49150 is a significant vulnerability in the Linux kernel's GameCube RTC driver, which can lead to memory leaks and system instability. Users are advised to update to the patched version 5.17.3-1 to ensure their systems remain secure. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49150 is a vulnerability in the Linux kernel related to a reference count leak in the GameCube RTC driver.
This vulnerability can lead to memory leaks and potentially exhaust system resources, affecting the stability and performance of the kernel.
Yes, the vulnerability has been patched in version 5.17.3-1 of the Linux package.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
While there are no specific workarounds, it is recommended to prioritize updating your package to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
