Critical Memory Leak Fix in Linux Kernel's DWC3 USB Driver
Summary
CVE-2022-50357: In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: core: fix some leaks in probe The dwc3_get_properties() function calls: dwc->usb_psy = power_supply_get_by_name(usb_psy_name); so there is so... Affects linux versions < 6.0.3-1. Fixed in 6.0.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of hardware architectures and is known for its stability and performance. The DWC3 USB driver is responsible for managing USB devices connected to the system. This vulnerability affects versions of the Linux kernel in Debian 12, 13, and 14, highlighting a critical issue in the DWC3 USB driver that could lead to memory leaks during device probe operations.
Vulnerability Detail
In the Linux kernel, specifically within the DWC3 USB driver, a vulnerability has been identified that involves memory leaks during the probe process. The function dwc3_get_properties() calls power_supply_get_by_name(usb_psy_name), which does not adequately handle error paths, leading to potential memory leaks. This could result in increased memory usage over time, potentially causing system instability or crashes if not addressed.
How To Fix
Minimum fixed version
6.0.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch as soon as possible to mitigate the risk.
Conclusion
The CVE-2022-50357 vulnerability in the Linux kernel's DWC3 USB driver poses a significant risk due to memory leaks during device probing. It is crucial for users of Debian 12, 13, and 14 to update their systems to version 6.0.3-1 or later to mitigate this risk. Utilizing tools like Vulert can further enhance your ability to monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50357 is a vulnerability in the Linux kernel's DWC3 USB driver that can lead to memory leaks during device probing.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
If exploited, this vulnerability could lead to increased memory usage, potentially causing system instability or crashes.
You can update your Linux kernel by running 'sudo apt-get update && sudo apt-get install linux' in your terminal.
Yes, you can use Vulert's playground to monitor and alert for open-source vulnerabilities in your software in real-time.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
