Refcount Leak in Linux Kernel's fwnode_graph_get_next_endpoint - Linux Package Vulnerability
Summary
CVE-2022-49752: In the Linux kernel, the following vulnerability has been resolved: device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() The 'parent' returned by fwnode_graph_get_port_parent() with refcount inc... Affects linux versions < 6.1.11-1. Fixed in 6.1.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and flexibility, making it a popular choice for servers, desktops, and embedded systems. However, like any complex software, it is susceptible to vulnerabilities that can affect system security and performance. This specific vulnerability pertains to a reference count leak in the function fwnode_graph_get_next_endpoint, which could lead to resource mismanagement.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the fwnode_graph_get_next_endpoint function, where the reference count of the 'parent' node was not properly decremented after being incremented when 'prev' was not NULL. This oversight can lead to a memory leak, potentially exhausting system resources and causing instability. The issue arises from the handling of const pointers, necessitating the introduction of a new variable to manage the reference count correctly.
How To Fix
Minimum fixed version
6.1.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The CVE-2022-49752 vulnerability in the Linux kernel highlights the importance of maintaining updated software to prevent potential resource management issues. Users are encouraged to apply the necessary updates promptly to ensure system stability and security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49752 is a vulnerability in the Linux kernel related to a reference count leak in the fwnode_graph_get_next_endpoint function.
This vulnerability can lead to memory leaks, potentially exhausting system resources and causing instability in the operating system.
If you are using Debian versions 12 or 13 with Linux kernel versions prior to 6.1.11-1, your system is affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is advisable to monitor the situation and apply the patch as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
