Memory Leak Vulnerability in Linux Kernel's IOSM Driver
Summary
CVE-2022-49867: In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix memory leak in ipc_wwan_dellink IOSM driver registers network device without setting the needs_free_netdev flag, and does NOT call... Affects linux versions < 6.0.10-1. Fixed in 6.0.10-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports various functionalities, including process management, memory management, and device control. The IOSM (Intel Open Source Modem) driver is a part of the kernel that facilitates communication between the modem hardware and the operating system. This driver is crucial for enabling mobile broadband connectivity. However, a recent vulnerability has been identified in the IOSM driver, which can lead to memory leaks, potentially affecting system performance and stability.
Vulnerability Detail
The vulnerability arises from the IOSM driver registering a network device without setting the 'needs_free_netdev' flag. As a result, when the network device is unregistered, the driver fails to call 'free_netdev()', leading to a memory leak. This issue can accumulate over time, consuming system resources and potentially causing the system to slow down or crash. The vulnerability has been assigned the identifier CVE-2022-49867 and affects specific versions of the Linux kernel in Debian distributions.
How To Fix
Minimum fixed version
6.0.10-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating the Linux package as described above.
Conclusion
The CVE-2022-49867 vulnerability in the Linux kernel's IOSM driver poses a significant risk due to memory leaks that can affect system performance. It is essential to update to the patched version to ensure system stability and security. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49867 is a vulnerability in the Linux kernel's IOSM driver that causes a memory leak due to improper handling of network device registration.
The memory leak can lead to increased memory usage over time, potentially slowing down your system or causing it to crash.
If you are using a version of the Linux kernel prior to 6.0.10-1 in Debian 12 or 13, your system may be vulnerable.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
While there are no specific workarounds, it is crucial to plan for an update to mitigate the risk associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
