Refcount Leak in Linux Kernel: Fix for aspeed_adc_set_trim_data
Summary
CVE-2022-49684: In the Linux kernel, the following vulnerability has been resolved: iio: adc: aspeed: Fix refcount leak in aspeed_adc_set_trim_data of_find_node_by_name() returns a node pointer with refcount incremented, we should use o... Affects linux versions < 5.18.14-1. Fixed in 5.18.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and security features. The kernel is modular, allowing for the addition of various drivers and subsystems, including the IIO (Industrial I/O) subsystem, which handles data from sensors and other input devices. The vulnerability in question affects the aspeed_adc driver within the IIO subsystem, which is responsible for interfacing with analog-to-digital converters on Aspeed systems.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49684, arises from a refcount leak in the aspeed_adc_set_trim_data function. The issue occurs when the function calls of_find_node_by_name(), which returns a node pointer with an incremented reference count. If the reference count is not decremented using of_node_put() after the node is no longer needed, it leads to a memory leak. This leak can potentially exhaust system resources, leading to degraded performance or system instability. The vulnerability was introduced in earlier versions of the Linux kernel and has been addressed in the patched version.
How To Fix
Minimum fixed version
5.18.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The recommended action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
CVE-2022-49684 is a critical vulnerability in the Linux kernel that affects the aspeed_adc driver due to a refcount leak. Users are strongly encouraged to update to the patched version to mitigate potential risks. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in your software.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49684 is a vulnerability in the Linux kernel related to a refcount leak in the aspeed_adc driver, which can lead to memory leaks and potential system instability.
You can check if your system is affected by using tools like Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
The consequences include potential memory leaks that can exhaust system resources, leading to degraded performance or system crashes.
Yes, a patch is available in the form of the Linux kernel version 5.18.14-1 or later, which resolves the refcount leak issue.
While there are no specific workarounds, it is advisable to monitor your system for unusual behavior and plan to update your kernel as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
