Refcount Leak in Linux Kernel's Ndisc Router Discovery - CVE-2022-50043
Summary
CVE-2022-50043: In the Linux kernel, the following vulnerability has been resolved: net: fix potential refcount leak in ndisc_router_discovery() The issue happens on specific paths in the function. Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. It is widely used in various distributions, including Debian. This vulnerability specifically affects the network subsystem, where improper reference counting can lead to memory leaks, impacting system performance and stability.
Vulnerability Detail
CVE-2022-50043 is a vulnerability in the Linux kernel's ndisc_router_discovery() function. It arises when the function fails to decrement the reference count of a network neighbor object after it has been replaced. This oversight can lead to memory leaks, as the memory allocated for the neighbor object is not released, potentially exhausting system resources over time. The issue occurs under specific conditions when the route and neighbor objects are manipulated, particularly when the lifetime is nonzero but the metric needs to change.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-50043 is a significant vulnerability in the Linux kernel that can lead to memory leaks due to improper reference counting. It is crucial to update to the patched version to ensure system stability and performance. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50043 is a vulnerability in the Linux kernel that can lead to memory leaks due to improper reference counting in the ndisc_router_discovery() function.
If exploited, this vulnerability can lead to memory leaks, which may degrade system performance and stability over time.
The vulnerability affects the Linux kernel versions prior to 6.0.2-1 on Debian 12 and 13.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file, you can check if your application is affected by CVE-2022-50043.
While there are no specific workarounds available, it is advisable to monitor your system for unusual behavior and apply the patch as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
