Memory Leak Vulnerability in Linux Kernel Bluetooth Module - CVE-2022-49908
Summary
CVE-2022-49908: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix memory leak in vhci_write Syzkaller reports a memory leak as follows: ==================================== BUG: memory leak unrefe... Affects linux versions < 6.0.8-1. Fixed in 6.0.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports various functionalities, including process management, memory management, and device control. The Bluetooth module within the kernel facilitates wireless communication between devices. This vulnerability affects the Bluetooth L2CAP layer, which is responsible for managing data packets in Bluetooth communication.
Vulnerability Detail
CVE-2022-49908 is a memory leak vulnerability in the Linux kernel's Bluetooth subsystem, specifically in the vhci_write function. The issue arises when the HCI core fails to free memory allocated for socket buffers (skbs) after processing certain ACL data packets. When the start fragment does not contain the L2CAP length, the skb is copied into a connection's rx_skb without being freed, leading to a memory leak. This can result in increased memory consumption over time, potentially causing system instability or crashes.
How To Fix
Minimum fixed version
6.0.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available.
Conclusion
CVE-2022-49908 is a significant memory leak vulnerability in the Linux kernel's Bluetooth subsystem that requires immediate attention. Users are advised to update their systems to the patched version to prevent potential memory-related issues. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49908 is a memory leak vulnerability in the Linux kernel's Bluetooth subsystem that can lead to increased memory usage.
If exploited, this vulnerability can cause memory leaks, potentially leading to system instability or crashes due to excessive memory consumption.
The vulnerability affects versions of the Linux kernel prior to 6.0.8-1 in Debian 12 and 13.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, a patch is available in version 6.0.8-1 and later for Debian systems. Updating to this version will resolve the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
