Refcount Leak in Linux Kernel's Apple AIC IRQ Chip - CVE-2022-49717
Summary
CVE-2022-49717: In the Linux kernel, the following vulnerability has been resolved: irqchip/apple-aic: Fix refcount leak in build_fiq_affinity of_find_node_by_phandle() returns a node pointer with refcount incremented, we should use of_... Affects linux versions < 5.18.14-1. Fixed in 5.18.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It is known for its robustness and flexibility, supporting a wide range of devices and architectures. The vulnerability in question affects the Apple AIC IRQ chip, which is responsible for managing interrupt requests in Apple hardware. This vulnerability could lead to resource mismanagement, potentially affecting system stability and performance.
Vulnerability Detail
CVE-2022-49717 is a vulnerability in the Linux kernel related to the Apple AIC IRQ chip. The issue arises from a refcount leak in the function build_fiq_affinity, where the function of_find_node_by_phandle() returns a node pointer with an incremented reference count. If the reference count is not decremented using of_node_put() when the node is no longer needed, it leads to a memory leak. This could result in increased memory usage over time, potentially leading to system crashes or degraded performance.
How To Fix
Minimum fixed version
5.18.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2022-49717 is a critical vulnerability in the Linux kernel affecting the Apple AIC IRQ chip due to a refcount leak. It is essential to update to the patched version to mitigate potential risks associated with this issue. Regular monitoring and timely updates are crucial for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49717 is a vulnerability in the Linux kernel related to a refcount leak in the Apple AIC IRQ chip.
This vulnerability can lead to increased memory usage and potential system instability or crashes due to resource mismanagement.
Yes, a patch is available in version 5.18.14-1 of the Linux package.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
While there are no specific workarounds, it is advisable to monitor your system for unusual behavior and apply the patch as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
