Memory Leak Vulnerability in Linux Kernel's fbdev Package
Summary
CVE-2022-50404: In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: release buffer when fbcon_do_set_font() failed syzbot is reporting memory leak at fbcon_do_set_font() [1], for commit a5a923038d70 ("fbdev... Affects linux versions < 6.1.4-1. Fixed in 6.1.4-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. The fbdev subsystem is responsible for managing framebuffer devices, allowing graphics to be displayed on the screen. This subsystem is crucial for rendering graphics in environments where direct access to the hardware is required. However, it has been identified that a specific issue within the fbdev implementation can lead to memory leaks, impacting system performance and stability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the fbdev subsystem, specifically within the fbcon_do_set_font() function. This issue arises when the function fails to release a buffer that may have been newly allocated by fbcon_set_font(). As a result, this oversight can lead to a memory leak, where memory is not properly freed, potentially causing the system to exhaust available memory over time. This vulnerability is linked to commit a5a923038d70, which aimed to properly revert changes during font setting operations but inadvertently introduced this memory management flaw.
How To Fix
Minimum fixed version
6.1.4-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds documented for this vulnerability. It is advisable to monitor system memory usage and apply the patch as soon as it is available.
Conclusion
The CVE-2022-50404 vulnerability in the Linux kernel's fbdev subsystem poses a significant risk due to potential memory leaks. It is essential for users to update to the patched version to mitigate this issue and ensure system stability.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50404 is a vulnerability in the Linux kernel's fbdev subsystem that can lead to memory leaks due to improper buffer management.
This vulnerability can cause your system to experience performance degradation over time as memory leaks accumulate, potentially leading to system instability.
If you are using Debian versions 12, 13, or 14 with the Linux kernel prior to version 6.1.4-1, your system is at risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
While there are no specific workarounds, it is crucial to monitor your system's memory usage and plan to apply the patch as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
