Memory Leak Vulnerability in Linux Kernel: mt76 Driver for Debian Packages
Summary
CVE-2022-49230: In the Linux kernel, the following vulnerability has been resolved: mt76: mt7915: fix possible memory leak in mt7915_mcu_add_sta Free allocated skb in mt7915_mcu_add_sta routine in case of failures. Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware and system resources. It supports a wide range of functionalities, including process management, memory management, device drivers, and system calls. The mt76 driver is specifically designed for wireless devices, enabling communication between the operating system and network hardware. This vulnerability affects Debian packages of the Linux kernel, specifically versions prior to 5.17.3-1, which may lead to memory leaks under certain conditions.
Vulnerability Detail
CVE-2022-49230 is a vulnerability found in the mt76 driver of the Linux kernel, specifically in the mt7915_mcu_add_sta function. The issue arises from a failure to free allocated socket buffers (skbs) in case of errors during the execution of this function. This oversight can lead to memory leaks, potentially exhausting system memory and causing performance degradation or system crashes. The vulnerability is particularly concerning for systems that rely heavily on wireless connectivity, as it may affect stability and reliability.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch as soon as possible.
Conclusion
CVE-2022-49230 is a critical vulnerability in the mt76 driver of the Linux kernel that can lead to memory leaks. Users of Debian packages should promptly update to version 5.17.3-1 or later to ensure system stability and security. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49230 is a vulnerability in the mt76 driver of the Linux kernel that can lead to memory leaks due to improper handling of socket buffers.
This vulnerability can cause memory leaks, potentially leading to system instability, performance degradation, or crashes, especially in systems using wireless connectivity.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities. By using the manifest file like package-lock.json, you can check if your application is affected without requiring access to the code.
Yes, a patch is available in the form of the Linux kernel version 5.17.3-1 or later. It is recommended to update your system to this version.
While there are no specific workarounds, it is advisable to monitor system performance closely and apply the patch as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
