Memory Leak Vulnerability in Linux Kernel - ThinkPad ACPI Module
Summary
CVE-2022-49665: In the Linux kernel, the following vulnerability has been resolved: platform/x86: thinkpad_acpi: Fix a memory leak of EFCH MMIO resource Unlike release_mem_region(), a call to release_resource() does not free the resourc... Affects linux versions < 5.18.14-1. Fixed in 5.18.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for all other parts of the system. It manages hardware resources, system calls, and process management. The ThinkPad ACPI module is a part of the kernel that allows for advanced power management and hardware control on ThinkPad laptops. This module is crucial for ensuring optimal performance and energy efficiency. However, it has been identified to have a vulnerability that could lead to memory leaks, affecting system stability and performance.
Vulnerability Detail
In the Linux kernel, specifically within the ThinkPad ACPI module, a vulnerability has been discovered that results in a memory leak due to improper resource management. The issue arises from the use of the release_resource() function, which does not free the memory allocated for the EFCH MMIO resource. This oversight can lead to increased memory consumption over time, potentially causing system slowdowns or crashes. The vulnerability is particularly concerning for systems that rely heavily on the ThinkPad ACPI functionalities, as it may degrade performance and reliability.
How To Fix
Minimum fixed version
5.18.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The CVE-2022-49665 vulnerability in the Linux kernel's ThinkPad ACPI module poses a significant risk due to memory leaks that can affect system performance. Users are strongly encouraged to update to the patched version 5.18.14-1 to mitigate this issue. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49665 is a vulnerability in the Linux kernel's ThinkPad ACPI module that causes a memory leak due to improper resource management.
This vulnerability can lead to increased memory usage, potentially causing system slowdowns or crashes, especially on systems that utilize the ThinkPad ACPI functionalities.
Yes, a patch is available in version 5.18.14-1 of the Linux kernel. Users should update to this version or later to mitigate the risk.
While there are no specific workarounds, it is advisable to monitor your system's memory usage and apply the patch as soon as possible.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
