Memory Leak Vulnerability in Linux Kernel: blk-cgroup Package Affected
Summary
CVE-2022-49786: In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: properly pin the parent in blkcg_css_online blkcg_css_online is supposed to pin the blkcg of the parent, but 397c9f46ee4d refactored things... Affects linux versions < 6.0.10-1. Fixed in 6.0.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, managing hardware and system resources. It provides essential services for all other parts of the system, including process management, memory management, and device drivers. The blk-cgroup subsystem is responsible for managing block device I/O control groups, allowing for resource allocation and management. This vulnerability affects the blk-cgroup functionality, leading to potential memory leaks and resource mismanagement.
Vulnerability Detail
In the Linux kernel, a vulnerability identified as CVE-2022-49786 has been discovered in the blk-cgroup subsystem. The issue arises from a refactoring change in the code that altered the behavior of the blkcg_css_online function. Instead of properly pinning the parent block control group (blkcg), the function now incorrectly pins the control group state (css). This mismanagement can lead to memory leaks, as the system ends up with extra pins on the control group, resulting in leaked blkcgs and cgroups. The ramifications include increased memory usage and potential system instability over time.
How To Fix
Minimum fixed version
6.0.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
The CVE-2022-49786 vulnerability in the Linux kernel's blk-cgroup subsystem poses a significant risk due to potential memory leaks and system instability. Users are strongly advised to update their kernel to the fixed version 6.0.10-1 to mitigate these risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49786 is a vulnerability in the Linux kernel's blk-cgroup subsystem that can lead to memory leaks due to improper handling of control group references.
This vulnerability can cause increased memory usage and potential system instability as it leads to leaked block control groups and control groups.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
While there are no specific workarounds, it is recommended to prioritize updating your kernel to mitigate the risks associated with this vulnerability.
Detailed information can be found in the official CVE database and security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
