Memory Leak Vulnerability in Open vSwitch - Linux Kernel
Summary
CVE-2022-49959: In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix memory leak at failed datapath creation ovs_dp_cmd_new()->ovs_dp_change()->ovs_dp_set_upcall_portids() allocates array via kmalloc. Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system, managing hardware resources and providing essential services for software applications. Open vSwitch (OVS) is a multilayer virtual switch designed to enable network automation while supporting standard management interfaces and protocols. This vulnerability affects the OVS component of the Linux kernel, specifically during the creation of a new datapath, which can lead to memory leaks if not properly handled.
Vulnerability Detail
The vulnerability, identified as CVE-2022-49959, arises from a failure to free allocated memory when the function new_vport() fails during the execution of ovs_dp_cmd_new(). This oversight results in a memory leak, as the allocated array via kmalloc is not released, leading to potential resource exhaustion and degraded system performance. The specific function calls involved are ovs_dp_cmd_new() -> ovs_dp_change() -> ovs_dp_set_upcall_portids(). The memory leak can be observed through kmemleak, which highlights unreferenced objects in the system.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2022-49959 is a significant vulnerability in the Linux kernel's Open vSwitch component that can lead to memory leaks if not addressed. It is essential to update to the patched version to ensure system stability and security. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49959 is a vulnerability in the Linux kernel related to Open vSwitch that causes a memory leak during the creation of a new datapath.
This vulnerability can lead to memory leaks, which may result in resource exhaustion and degraded system performance over time.
Yes, the patched version for Debian 12 and 13 is 6.0.2-1. It is advisable to update to this version to mitigate the risk.
While there are no specific workarounds, it is crucial to monitor your system for unusual behavior and plan for an update as soon as possible.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
