Memory Leak Vulnerability in Linux Kernel CIFS Module - CVE-2022-50372
Summary
CVE-2022-50372: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix memory leak when build ntlmssp negotiate blob failed There is a memory leak when mount cifs: unreferenced object 0xffff888166059600 (size 448)... Affects linux versions < 6.0.6-1. Fixed in 6.0.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, including various distributions of Linux. It manages hardware resources and provides essential services for applications. The CIFS (Common Internet File System) module allows for file sharing over a network, enabling users to access files on remote servers as if they were local. This vulnerability arises from a memory leak in the CIFS module when handling NTLMSSP negotiate blobs, which can lead to increased memory usage and potential system instability.
Vulnerability Detail
CVE-2022-50372 is a memory leak vulnerability found in the Linux kernel's CIFS module. When a session setup request fails during the negotiation of NTLMSSP, the allocated memory is not properly released, leading to a memory leak. This can result in unreferenced objects persisting in memory, which may eventually exhaust system resources, causing performance degradation or crashes. The vulnerability affects multiple Debian versions, including Debian 12, 13, and 14, and is introduced from version 0 up to the fixed version 6.0.6-1.
How To Fix
Minimum fixed version
6.0.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate the risk.
Conclusion
CVE-2022-50372 is a significant memory leak vulnerability in the Linux kernel's CIFS module that requires immediate attention. Users are advised to update their systems to the patched version to prevent potential performance issues and system crashes. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50372 is a memory leak vulnerability in the Linux kernel's CIFS module that can lead to increased memory usage and potential system instability.
If exploited, this vulnerability can cause memory leaks, leading to performance issues and possibly crashing the system due to resource exhaustion.
Debian versions 12, 13, and 14 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without any signup.
While there are no specific workarounds, it is crucial to plan for an update to the patched version as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
