Refcount Leak in Linux Kernel's MTD Parser: bcm4908_partitions_fw_offset
Summary
CVE-2022-50155: In the Linux kernel, the following vulnerability has been resolved: mtd: parsers: ofpart: Fix refcount leak in bcm4908_partitions_fw_offset of_find_node_by_path() returns a node pointer with refcount incremented, we shou... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system processes. It is widely used in various distributions, including Debian. The kernel's MTD (Memory Technology Device) subsystem manages flash memory devices, and the bcm4908_partitions_fw_offset is a specific parser within this subsystem. This parser is responsible for handling partition information for certain hardware configurations, making it crucial for system stability and performance.
Vulnerability Detail
The vulnerability identified as CVE-2022-50155 is a reference count leak in the bcm4908_partitions_fw_offset parser of the Linux kernel. This issue arises when the function of_find_node_by_path() is called, which increments the reference count of a node pointer. If the pointer is not properly released using of_node_put(), it leads to a memory leak that can degrade system performance over time. This vulnerability can potentially allow an attacker to exploit the memory management system, leading to resource exhaustion or other unintended behaviors.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the available patch as mentioned above.
Conclusion
CVE-2022-50155 is a significant vulnerability in the Linux kernel that can lead to memory leaks and system instability. It is essential for users of Debian 12 and 13 to update their Linux packages to the fixed version 6.0.2-1 to ensure system security. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the integrity of your software.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50155 is a vulnerability in the Linux kernel that involves a reference count leak in the bcm4908_partitions_fw_offset parser.
This vulnerability can lead to memory leaks, which may degrade system performance and stability over time.
If you are using Debian 12 or Debian 13 with the Linux kernel version prior to 6.0.2-1, your system is affected.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
