Refcount Leak in Linux Kernel's PCI Mediatek Gen3 - CVE-2022-50154
Summary
CVE-2022-50154: In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek-gen3: Fix refcount leak in mtk_pcie_init_irq_domains() of_get_child_by_name() returns a node pointer with refcount incremented, so we shou... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of hardware architectures and is known for its stability and performance. The vulnerability CVE-2022-50154 affects the PCI subsystem, specifically the Mediatek Gen3 implementation, which is responsible for managing PCI devices. This vulnerability arises from improper reference counting, which can lead to resource leaks and potential system instability.
Vulnerability Detail
CVE-2022-50154 is a vulnerability in the Linux kernel where a reference count leak occurs in the function mtk_pcie_init_irq_domains(). The function of_get_child_by_name() returns a node pointer with an incremented reference count, but the code fails to release this reference when it is no longer needed. This oversight can lead to memory leaks, potentially exhausting system resources and affecting overall system performance. The issue has been identified and resolved in the patched version of the kernel.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability other than applying the patch. It is recommended to update the package as soon as possible to mitigate any risks associated with the refcount leak.
Conclusion
CVE-2022-50154 is a significant vulnerability in the Linux kernel that can lead to resource leaks due to improper reference counting. It is essential to update to the patched version to ensure system stability and performance. Regular monitoring of vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50154 is a vulnerability in the Linux kernel related to a reference count leak in the PCI Mediatek Gen3 implementation.
The vulnerability can lead to memory leaks, which may exhaust system resources and affect overall system stability and performance.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
More information can be found in the official CVE database and on the Linux kernel mailing lists where the issue was discussed.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
