Memory Leak Vulnerability in Linux Kernel Firmware Upload Handling
Summary
CVE-2022-49949: In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix memory leak in firmware upload In the case of firmware-upload, an instance of struct fw_upload is allocated in firmware_upload_regi... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It is widely used in various distributions, including Debian. The kernel's firmware loader is responsible for managing firmware uploads to devices. This vulnerability specifically affects the firmware upload process, where memory allocated for firmware upload instances is not properly freed, leading to potential memory leaks.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49949, arises from a memory leak in the firmware upload process within the Linux kernel. When firmware is uploaded, an instance of the struct fw_upload is allocated but not freed correctly in the fw_dev_release function. This oversight can lead to increased memory usage over time, potentially exhausting system resources and causing instability or crashes. The issue has been addressed by creating a new function, fw_upload_free, to handle the necessary memory deallocation.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
The CVE-2022-49949 vulnerability in the Linux kernel poses a significant risk due to memory leaks during firmware uploads. It is crucial for users to update their systems to the patched version to maintain stability and security. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49949 is a vulnerability in the Linux kernel that causes a memory leak during firmware uploads.
This vulnerability can lead to increased memory usage, potentially causing system instability or crashes over time.
Yes, a patch is available in version 6.0.2-1 for Debian 12 and 13.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software without needing to access the code.
Update your Linux kernel to the patched version 6.0.2-1 to fix the memory leak vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
