Memory Leak Vulnerability in Linux Kernel's MHI Driver
Summary
CVE-2022-49866: In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi: fix memory leak in mhi_mbim_dellink MHI driver registers network device without setting the needs_free_netdev flag, and does NOT call fr... Affects linux versions < 6.0.10-1. Fixed in 6.0.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of hardware architectures and is known for its stability and performance. The MHI (Mobile Hardware Interface) driver is responsible for managing mobile broadband devices, enabling communication between the kernel and these devices. However, a recent vulnerability has been identified in the MHI driver that could lead to memory leaks, affecting system performance and stability.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49866, arises from the MHI driver registering a network device without setting the 'needs_free_netdev' flag. As a result, when the network device is unregistered, the driver fails to call 'free_netdev()', leading to a memory leak. This issue can accumulate over time, potentially exhausting system memory and causing performance degradation or crashes. The vulnerability has been addressed in the Linux kernel version 6.0.10-1.
How To Fix
Minimum fixed version
6.0.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch by updating to the fixed version of the Linux kernel.
Conclusion
The CVE-2022-49866 vulnerability in the Linux kernel's MHI driver poses a significant risk of memory leaks, which can impact system performance. It is crucial to update to the patched version (6.0.10-1) to ensure system stability and security. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49866 is a vulnerability in the Linux kernel's MHI driver that can lead to memory leaks due to improper handling of network device registration.
This vulnerability can cause memory leaks, which may lead to system performance issues or crashes over time as memory resources are exhausted.
If you are using Debian 12 or Debian 13 with a version of the Linux kernel prior to 6.0.10-1, your system is affected by this vulnerability.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities, to check if your application is affected. Visit Vulert Scanner to use the Vulert playground without signup.
While there are no specific workarounds, it is advisable to monitor your system's memory usage and apply the update as soon as possible to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
