Refcount Leak in Linux Kernel's Mediatek PCI Subsystem - CVE-2022-49454
Summary
CVE-2022-49454: In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Fix refcount leak in mtk_pcie_subsys_powerup() The of_find_compatible_node() function returns a node pointer with refcount incremented, W... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. It supports a wide range of hardware architectures and is known for its stability and performance. The Mediatek PCI subsystem is responsible for managing PCI devices in systems using Mediatek hardware. This subsystem is crucial for ensuring proper communication between the operating system and hardware components, but it is susceptible to vulnerabilities that can lead to resource leaks and system instability.
Vulnerability Detail
CVE-2022-49454 is a vulnerability in the Linux kernel's Mediatek PCI subsystem, specifically in the mtk_pcie_subsys_powerup() function. The issue arises from a reference count leak due to the improper handling of the of_find_compatible_node() function, which increments the reference count of a node pointer. If the reference count is not decremented using of_node_put(), it can lead to resource leaks, potentially causing memory exhaustion and system instability. This vulnerability affects versions of the Linux kernel prior to 5.18.5-1.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2022-49454 is a critical vulnerability in the Linux kernel's Mediatek PCI subsystem that can lead to resource leaks and system instability. It is essential to update to the patched version 5.18.5-1 to mitigate the risks associated with this vulnerability. Regular monitoring and timely updates are crucial for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49454 is a vulnerability in the Linux kernel's Mediatek PCI subsystem that involves a reference count leak.
The vulnerability can lead to resource leaks, which may result in memory exhaustion and system instability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Yes, a patch is available in version 5.18.5-1 of the Linux package.
While there are no specific workarounds, it is recommended to monitor your system for unusual behavior until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
