Memory Reference Leak in Linux Kernel's RDMA/rxe Package - CVE-2022-49929
Summary
CVE-2022-49929: In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix mr leak in RESPST_ERR_RNR rxe_recheck_mr() will increase mr's ref_cnt, so we should call rxe_put(mr) to drop mr's ref_cnt in RESPST_ERR_RN... Affects linux versions < 6.0.8-1. Fixed in 6.0.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The RDMA (Remote Direct Memory Access) subsystem allows for high-throughput, low-latency networking, which is critical for performance in data centers and high-performance computing environments. The rxe (RDMA over Ethernet) driver is part of this subsystem, enabling RDMA capabilities over Ethernet networks. This vulnerability affects the memory management within the rxe driver, leading to potential resource leaks.
Vulnerability Detail
CVE-2022-49929 is a vulnerability in the Linux kernel's RDMA/rxe subsystem where a memory reference leak occurs during error handling in the RESPST_ERR_RNR state. The function rxe_recheck_mr() improperly increases the reference count of memory regions (mr) without corresponding decrements, leading to warnings and potential resource exhaustion. This can result in degraded performance or system instability as memory resources are not released correctly.
How To Fix
Minimum fixed version
6.0.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds have been provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-49929 represents a significant vulnerability in the Linux kernel's RDMA/rxe subsystem, leading to memory reference leaks that can affect system performance. It is essential to update to the patched version to ensure system stability and security. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49929 is a vulnerability in the Linux kernel's RDMA/rxe subsystem that causes a memory reference leak during error handling.
This vulnerability can lead to resource exhaustion, causing degraded performance or instability in systems utilizing the RDMA/rxe driver.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
While no specific workarounds are available, it is crucial to prioritize applying the patch as soon as possible to mitigate risks.
Detailed information can be found in the official CVE database and through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
