CVE-2022-49881

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49881
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix memory leak in query_regdb_file() In the function query_regdb_file() the alpha2 parameter is duplicated using kmemdup() and subsequently freed in regdb_fw_cb(). However, request_firmware_nowait() can fail without calling regdb_fw_cb() and thus leak memory.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0ede1a988299e95d54bd89551fd635980572e920 Patch
https://git.kernel.org/stable/c/219446396786330937bcd382a7bc4ccd767383bc Patch
https://git.kernel.org/stable/c/38c9fa2cc6bf4b6e1a74057aef8b5cffd23d3264 Patch
https://git.kernel.org/stable/c/57b962e627ec0ae53d4d16d7bd1033e27e67677a Patch
https://git.kernel.org/stable/c/e1e12180321f416d83444f2cdc9259e0f5093d35 Patch
https://git.kernel.org/stable/c/e9b5a4566d5bc71cc901be50d1fa24da00613120 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
History

07 May 2025, 13:21

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
References () https://git.kernel.org/stable/c/0ede1a988299e95d54bd89551fd635980572e920 - () https://git.kernel.org/stable/c/0ede1a988299e95d54bd89551fd635980572e920 - Patch
References () https://git.kernel.org/stable/c/219446396786330937bcd382a7bc4ccd767383bc - () https://git.kernel.org/stable/c/219446396786330937bcd382a7bc4ccd767383bc - Patch
References () https://git.kernel.org/stable/c/38c9fa2cc6bf4b6e1a74057aef8b5cffd23d3264 - () https://git.kernel.org/stable/c/38c9fa2cc6bf4b6e1a74057aef8b5cffd23d3264 - Patch
References () https://git.kernel.org/stable/c/57b962e627ec0ae53d4d16d7bd1033e27e67677a - () https://git.kernel.org/stable/c/57b962e627ec0ae53d4d16d7bd1033e27e67677a - Patch
References () https://git.kernel.org/stable/c/e1e12180321f416d83444f2cdc9259e0f5093d35 - () https://git.kernel.org/stable/c/e1e12180321f416d83444f2cdc9259e0f5093d35 - Patch
References () https://git.kernel.org/stable/c/e9b5a4566d5bc71cc901be50d1fa24da00613120 - () https://git.kernel.org/stable/c/e9b5a4566d5bc71cc901be50d1fa24da00613120 - Patch
CWE CWE-401
CPE cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*

02 May 2025, 13:52

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: wifi: cfg80211: se corrige una fuga de memoria en query_regdb_file(). En la función query_regdb_file(), el parámetro alpha2 se duplica mediante kmemdup() y posteriormente se libera en regdb_fw_cb(). Sin embargo, request_firmware_nowait() puede fallar sin llamar a regdb_fw_cb() y, por lo tanto, provocar una fuga de memoria.

01 May 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:16

Updated : 2025-05-07 13:21

NVD link : CVE-2022-49881

Mitre link : CVE-2022-49881

CVE.ORG link : CVE-2022-49881

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime