Memory Leak Vulnerability in Linux Kernel - Package: linux
Summary
CVE-2022-49860: In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix memory leak when register device fail If device_register() fails, it should call put_device() to give up reference, the... Affects linux versions < 6.0.10-1. Fixed in 6.0.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It is known for its stability, performance, and extensive hardware support. However, like any complex software, it is susceptible to vulnerabilities that can affect system performance and security. This specific vulnerability pertains to the device registration process within the kernel, which, if mishandled, can lead to memory leaks.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the dmaengine subsystem, specifically within the ti: k3-udma-glue component. The issue arises when the device_register() function fails; the kernel does not properly release the memory allocated for the device name. This oversight can lead to memory leaks, potentially exhausting system resources and degrading performance over time. The vulnerability has been assigned the identifier CVE-2022-49860.
How To Fix
Minimum fixed version
6.0.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the linux package.
Conclusion
The vulnerability CVE-2022-49860 in the Linux kernel poses a significant risk due to potential memory leaks during device registration failures. Users are encouraged to update their linux package to version 6.0.10-1 to ensure their systems remain secure and efficient. Regular monitoring and timely updates are crucial in maintaining system integrity.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49860 is a vulnerability in the Linux kernel that can lead to memory leaks due to improper handling of device registration failures.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
The primary risk is the potential for memory leaks, which can lead to resource exhaustion, degraded system performance, and instability.
Yes, a patch is available in version 6.0.10-1 of the linux package. Updating to this version will resolve the issue.
While there are no specific workarounds, it is advisable to monitor your system's performance and apply the update as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
