Refcount Leak in Linux Kernel's SCMI Regulator - CVE-2022-49466
Summary
CVE-2022-49466: In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: Fix refcount leak in scmi_regulator_probe of_find_node_by_name() returns a node pointer with refcount incremented, we should use of_nod... Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and flexibility, making it a popular choice for servers, desktops, and embedded systems. This vulnerability affects the SCMI (System Control and Management Interface) regulator, which is responsible for managing power and performance in various hardware components. The issue arises from improper reference counting, leading to potential memory leaks.
Vulnerability Detail
CVE-2022-49466 is a vulnerability in the Linux kernel's SCMI regulator implementation. The problem originates from the function 'of_find_node_by_name()', which returns a node pointer with an incremented reference count. If the reference count is not properly decremented using 'of_node_put()', it leads to a memory leak. This can result in increased memory usage over time, potentially causing performance degradation or system instability. The vulnerability was resolved in version 5.18.5-1 of the affected packages.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2022-49466 is a significant vulnerability in the Linux kernel that can lead to memory leaks due to improper reference counting in the SCMI regulator. It is crucial to update to the patched version 5.18.5-1 to mitigate this risk. Users are encouraged to utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49466 is a vulnerability in the Linux kernel related to a refcount leak in the SCMI regulator implementation.
This vulnerability can lead to memory leaks, which may cause increased memory usage and potentially degrade system performance over time.
If you are using a version of Linux prior to 5.18.5-1, your system may be affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is recommended to monitor your system for unusual memory usage until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
