Memory Leak Vulnerability in Linux Kernel: ath11k Package
Summary
CVE-2022-49237: In the Linux kernel, the following vulnerability has been resolved: ath11k: add missing of_node_put() to avoid leak The node pointer is returned by of_find_node_by_type() or of_parse_phandle() with refcount incremented. Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including Debian. It manages system resources and hardware communication. The ath11k package is responsible for supporting Qualcomm Atheros 802.11ax wireless devices. This package is critical for enabling wireless connectivity and ensuring efficient communication between the operating system and hardware. However, it has been found to contain a vulnerability that could lead to memory leaks, potentially affecting system performance and stability.
Vulnerability Detail
In the Linux kernel, specifically within the ath11k package, a vulnerability has been identified where the function of_node_put() was not called after using of_find_node_by_type() or of_parse_phandle(). This oversight results in a reference count leak, which can lead to increased memory usage and, in severe cases, system instability. The vulnerability was introduced in earlier versions of the package and has been addressed in the fixed version 5.17.3-1.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described above.
Conclusion
The CVE-2022-49237 vulnerability in the Linux kernel's ath11k package poses a significant risk due to memory leaks. Users are strongly encouraged to update to the fixed version 5.17.3-1 to ensure system stability and performance. Regular monitoring for vulnerabilities using tools like Vulert can help maintain software security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49237 is a vulnerability in the Linux kernel's ath11k package that can lead to memory leaks due to a missing function call.
This vulnerability can cause increased memory usage, potentially leading to system performance degradation and instability.
If you are using an affected version of the Linux kernel, your system may be at risk. It is advisable to check your version and update accordingly.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
