Memory Leak Vulnerability in Linux Kernel's MHI Driver
Summary
CVE-2022-49817: In the Linux kernel, the following vulnerability has been resolved: net: mhi: Fix memory leak in mhi_net_dellink() MHI driver registers network device without setting the needs_free_netdev flag, and does NOT call free_ne... Affects linux versions < 6.0.10-1. Fixed in 6.0.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a core component of many operating systems, providing essential services and managing hardware resources. It supports a wide range of devices and is known for its stability and performance. The MHI (Mobile Host Interface) driver is responsible for facilitating communication between the host and mobile devices. This driver, while efficient, has been identified to have a memory leak issue that can lead to resource exhaustion if not addressed.
Vulnerability Detail
In the Linux kernel, specifically within the MHI driver, a vulnerability has been identified where the network device is registered without setting the 'needs_free_netdev' flag. Consequently, when the network device is unregistered, the 'free_netdev()' function is not called, leading to a memory leak. This issue can cause the system to consume excessive memory over time, potentially resulting in degraded performance or system crashes. The vulnerability has been assigned the identifier CVE-2022-49817.
How To Fix
Minimum fixed version
6.0.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the package as described above.
Conclusion
The memory leak vulnerability in the Linux kernel's MHI driver, identified as CVE-2022-49817, poses a risk to system stability due to improper memory management. It is crucial for users to update their Linux packages to the patched version to mitigate this risk effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49817 is a vulnerability in the Linux kernel's MHI driver that causes a memory leak due to improper handling of network device registration and unregistration.
This vulnerability can lead to increased memory usage over time, which may result in system slowdowns or crashes if not addressed.
Yes, a patch is available. Users should update to version 6.0.10-1 or later of the Linux package to fix the issue.
You can use Vulert, a tool that monitors open-source vulnerabilities in your software. By uploading your manifest file, you can check for vulnerabilities without needing to access the code.
Vulert is a service that allows users to monitor and alert for open-source vulnerabilities in their software using just a manifest file, such as package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
