Directory Fid Refcount Leak in Linux Kernel - CVE-2022-49705
Summary
CVE-2022-49705: In the Linux kernel, the following vulnerability has been resolved: 9p: fix fid refcount leak in v9fs_vfs_atomic_open_dotl We need to release directory fid if we fail halfway through open This fixes fid leaking with xfst... Affects linux versions < 5.18.14-1. Fixed in 5.18.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing system resources and hardware communication. It provides essential services for all other software running on the system. The kernel is modular, allowing for various functionalities to be added or removed as needed. This vulnerability specifically affects the 9p filesystem, which is used for communication between the Linux kernel and user-space applications, particularly in virtualized environments.
Vulnerability Detail
CVE-2022-49705 is a vulnerability in the Linux kernel that involves a reference count leak in the 9p filesystem during the atomic open operation. When the system attempts to open a directory file, if the operation fails midway, the directory file identifier (fid) is not released properly, leading to a memory leak. This can result in resource exhaustion over time, potentially causing system instability or crashes. The vulnerability was identified in the context of xfstests generic 531, which tests filesystem behavior.
How To Fix
Minimum fixed version
5.18.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate any risks associated with the leak.
Conclusion
CVE-2022-49705 is a significant vulnerability in the Linux kernel that can lead to resource leaks and system instability. It is crucial for users to update their systems to the patched version to mitigate the risks associated with this issue. Regular monitoring of open-source vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49705 is a vulnerability in the Linux kernel related to a reference count leak in the 9p filesystem during file operations.
If exploited, this vulnerability can lead to resource exhaustion, causing system instability or crashes over time.
Versions of the Linux kernel prior to 5.18.14-1 are affected by this vulnerability. Check your kernel version using 'uname -r'.
The best protection is to update your Linux kernel to version 5.18.14-1 or later, which contains the fix for this vulnerability.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software using just a manifest file. Visit https://vulert.com for more details.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
