Kernel Memory Leak Detector Disabled in Linux Kernel - CVE-2022-49994
Summary
CVE-2022-49994: In the Linux kernel, the following vulnerability has been resolved: bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem The vmemmap pages is marked by kmemleak when allocated from memblock. Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware and system resources. It provides essential services for all other parts of the operating system. This vulnerability affects the boot memory management, specifically the handling of vmemmap pages, which are crucial for memory allocation and deallocation processes.
Vulnerability Detail
CVE-2022-49994 is a vulnerability in the Linux kernel that arises from improper management of vmemmap pages by the kernel memory leak detector (kmemleak). When these pages are allocated from memblock, they are marked by kmemleak. However, upon freeing the page, they are not removed from kmemleak, leading to potential errors when the page is reused. This can cause kmemleak to report false errors and ultimately disable the kernel memory leak detection functionality, which may result in undetected memory leaks and system instability.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2022-49994 is a significant vulnerability in the Linux kernel that affects memory management and can lead to system instability. It is crucial to update to the patched version to ensure the integrity and reliability of your system.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49994 is a vulnerability in the Linux kernel that affects the kernel memory leak detector's ability to manage vmemmap pages properly.
The vulnerability can lead to kmemleak being disabled, which may result in undetected memory leaks and potential system instability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software without requiring access to the code or installation.
Yes, a patch is available in version 6.0.2-1 of the Linux package for Debian 12 and 13.
While there are no specific workarounds, it is advisable to monitor your system closely for any unusual behavior until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
