Refcount Leak in Linux Kernel's HDMI Encoder - CVE-2022-50188
Summary
CVE-2022-50188: In the Linux kernel, the following vulnerability has been resolved: drm/meson: Fix refcount leak in meson_encoder_hdmi_init of_find_device_by_node() takes reference, we should use put_device() to release it when not need... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It is widely used in various distributions, including Debian. The kernel's functionality includes process management, memory management, and device drivers. The vulnerability CVE-2022-50188 affects the DRM (Direct Rendering Manager) subsystem, specifically in the HDMI encoder, which is responsible for managing HDMI output. This vulnerability can lead to resource mismanagement and potential system instability.
Vulnerability Detail
CVE-2022-50188 is a vulnerability in the Linux kernel where a reference count leak occurs in the meson_encoder_hdmi_init function. The function calls of_find_device_by_node(), which increases the reference count of a device. However, if the function encounters an error, the reference count is not decremented properly, leading to a memory leak. This can result in resource exhaustion over time, potentially causing system crashes or degraded performance. The issue was resolved by adding a missing put_device() call in the error handling path.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any potential risks.
Conclusion
CVE-2022-50188 is a significant vulnerability in the Linux kernel that can lead to resource leaks and system instability. It is crucial to update to the patched version to ensure system integrity and performance. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50188 is a vulnerability in the Linux kernel that causes a reference count leak in the HDMI encoder, potentially leading to resource exhaustion.
If exploited, this vulnerability can lead to memory leaks, causing system instability and crashes over time.
Yes, a patch is available in version 6.0.2-1 of the Linux package for Debian 12 and 13.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
While there are no specific workarounds, it is advisable to monitor your system closely for any unusual behavior until you can apply the patch.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
