Refcount Leak in Linux Kernel's PCI Microchip Package - CVE-2022-50157
Summary
CVE-2022-50157: In the Linux kernel, the following vulnerability has been resolved: PCI: microchip: Fix refcount leak in mc_pcie_init_irq_domains() of_get_next_child() returns a node pointer with refcount incremented, so we should use o... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. The PCI Microchip package within the kernel facilitates communication between the operating system and PCI devices. This package is critical for ensuring that hardware components function correctly and efficiently. However, it is susceptible to vulnerabilities that can lead to resource leaks, impacting system stability and performance.
Vulnerability Detail
CVE-2022-50157 is a vulnerability in the Linux kernel's PCI Microchip package, specifically in the mc_pcie_init_irq_domains() function. The issue arises from a refcount leak due to improper handling of node pointers returned by the of_get_next_child() function. When the function is called, it increments the reference count of the node pointer, but if the pointer is not released using of_node_put() in certain error paths, it leads to a memory leak. This vulnerability can result in increased memory usage and potential system instability over time.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-50157 is a significant vulnerability in the Linux kernel's PCI Microchip package that can lead to memory leaks and system instability. Users are encouraged to update to the patched version 6.0.2-1 to mitigate the risk. Regular monitoring and prompt updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50157 is a vulnerability in the Linux kernel's PCI Microchip package that leads to a refcount leak, potentially causing memory issues.
If exploited, this vulnerability can lead to increased memory usage and system instability, affecting overall performance.
Yes, a patch is available in version 6.0.2-1 of the Linux kernel. Users should update to this version or later.
While there are no specific workarounds, it is advisable to monitor your system for unusual behavior and apply the patch as soon as possible.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
