Critical Multishot Accept Request Leak in Linux Kernel - CVE-2022-49791
Summary
CVE-2022-49791: In the Linux kernel, the following vulnerability has been resolved: io_uring: fix multishot accept request leaks Having REQ_F_POLLED set doesn't guarantee that the request is executed as a multishot from the polling path... Affects linux versions < 6.0.10-1. Fixed in 6.0.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resource allocation. It is widely used in various environments, from servers to embedded systems. This vulnerability affects the io_uring subsystem, which is designed to facilitate asynchronous I/O operations, enhancing performance and efficiency. The issue arises from improper handling of multishot accept requests, potentially leading to resource leaks.
Vulnerability Detail
CVE-2022-49791 is a vulnerability in the Linux kernel's io_uring subsystem, where requests marked with REQ_F_POLLED may not be executed as multishot from the polling path. This can lead to a situation where the system believes there is a multishot issue when there is none, resulting in the leaking of requests. Such leaks can degrade system performance and stability, as resources are not properly released, potentially leading to denial of service.
How To Fix
Minimum fixed version
6.0.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate the risk.
Conclusion
CVE-2022-49791 is a significant vulnerability in the Linux kernel's io_uring subsystem that can lead to resource leaks, affecting system performance. It is essential to update to the patched version to secure your system against potential exploitation.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49791 is a vulnerability in the Linux kernel related to the io_uring subsystem, which can lead to resource leaks under certain conditions.
This vulnerability can cause resource leaks, potentially degrading system performance and stability, and may lead to denial of service.
If you are using Debian 12 or 13 with a version of the Linux kernel prior to 6.0.10-1, your system is affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
