Refcount Leak in Linux Kernel's Apple AIC IRQ Chip - CVE-2022-49718
Summary
CVE-2022-49718: In the Linux kernel, the following vulnerability has been resolved: irqchip/apple-aic: Fix refcount leak in aic_of_ic_init of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_pu... Affects linux versions < 5.18.14-1. Fixed in 5.18.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. It is known for its robustness and flexibility, supporting a wide range of hardware architectures. The Apple AIC (Advanced Interrupt Controller) is a specific IRQ chip used in Apple devices, which facilitates the management of interrupts. This vulnerability pertains to a refcount leak in the initialization process of the AIC, which can lead to resource mismanagement and potential system instability.
Vulnerability Detail
CVE-2022-49718 is a vulnerability found in the Linux kernel related to the Apple AIC IRQ chip. The issue arises from the improper handling of reference counts when obtaining child nodes through the of_get_child_by_name() function. This function increments the reference count of the node pointer returned, but if the pointer is not properly released using of_node_put(), it results in a refcount leak. This leak can lead to resource exhaustion, potentially causing system crashes or degraded performance over time.
How To Fix
Minimum fixed version
5.18.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-49718 is a significant vulnerability in the Linux kernel affecting the Apple AIC IRQ chip, leading to a refcount leak that can compromise system stability. Users are advised to update their systems to the patched version to mitigate risks. Regular monitoring using tools like Vulert can help maintain awareness of such vulnerabilities.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49718 is a vulnerability in the Linux kernel related to a refcount leak in the Apple AIC IRQ chip initialization process.
If exploited, this vulnerability can lead to resource exhaustion, causing system instability, crashes, or degraded performance.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Yes, a patch is available in version 5.18.14-1 of the Linux package. It is recommended to update to this version to mitigate the vulnerability.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to protect your system from potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
