CVE-2022-49926

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49926
In the Linux kernel, the following vulnerability has been resolved: net: dsa: Fix possible memory leaks in dsa_loop_init() kmemleak reported memory leaks in dsa_loop_init(): kmemleak: 12 new suspected memory leaks unreferenced object 0xffff8880138ce000 (size 2048): comm "modprobe", pid 390, jiffies 4295040478 (age 238.976s) backtrace: [<000000006a94f1d5>] kmalloc_trace+0x26/0x60 [<00000000a9c44622>] phy_device_create+0x5d/0x970 [<00000000d0ee2afc>] get_phy_device+0xf3/0x2b0 [<00000000dca0c71f>] __fixed_phy_register.part.0+0x92/0x4e0 [<000000008a834798>] fixed_phy_register+0x84/0xb0 [<0000000055223fcb>] dsa_loop_init+0xa9/0x116 [dsa_loop] ... There are two reasons for memleak in dsa_loop_init(). First, fixed_phy_register() create and register phy_device: fixed_phy_register() get_phy_device() phy_device_create() # freed by phy_device_free() phy_device_register() # freed by phy_device_remove() But fixed_phy_unregister() only calls phy_device_remove(). So the memory allocated in phy_device_create() is leaked. Second, when mdio_driver_register() fail in dsa_loop_init(), it just returns and there is no cleanup for phydevs. Fix the problems by catching the error of mdio_driver_register() in dsa_loop_init(), then calling both fixed_phy_unregister() and phy_device_free() to release phydevs. Also add a function for phydevs cleanup to avoid duplacate.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/37a098fc9b42bd7fce66764866aa514639667b6e Patch
https://git.kernel.org/stable/c/4d2024b138d9f7b02ae13ee997fd3a71e9e46254 Patch
https://git.kernel.org/stable/c/633efc8b3dc96f56f5a57f2a49764853a2fa3f50 Patch
https://git.kernel.org/stable/c/935b4beb724946a37cebf97191592d4879d3a3a3 Patch
https://git.kernel.org/stable/c/9f555b1584fc2d5d16ee3c4d9438e93ac7c502c7 Patch
https://git.kernel.org/stable/c/bbc5d7b46a729bfcbb5544f6612b7a67dd4f4d6f Patch
https://git.kernel.org/stable/c/d593e1ede655b74c42e4e4fe285ea64aee96fb5c Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
History

07 May 2025, 13:28

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/37a098fc9b42bd7fce66764866aa514639667b6e - () https://git.kernel.org/stable/c/37a098fc9b42bd7fce66764866aa514639667b6e - Patch
References () https://git.kernel.org/stable/c/4d2024b138d9f7b02ae13ee997fd3a71e9e46254 - () https://git.kernel.org/stable/c/4d2024b138d9f7b02ae13ee997fd3a71e9e46254 - Patch
References () https://git.kernel.org/stable/c/633efc8b3dc96f56f5a57f2a49764853a2fa3f50 - () https://git.kernel.org/stable/c/633efc8b3dc96f56f5a57f2a49764853a2fa3f50 - Patch
References () https://git.kernel.org/stable/c/935b4beb724946a37cebf97191592d4879d3a3a3 - () https://git.kernel.org/stable/c/935b4beb724946a37cebf97191592d4879d3a3a3 - Patch
References () https://git.kernel.org/stable/c/9f555b1584fc2d5d16ee3c4d9438e93ac7c502c7 - () https://git.kernel.org/stable/c/9f555b1584fc2d5d16ee3c4d9438e93ac7c502c7 - Patch
References () https://git.kernel.org/stable/c/bbc5d7b46a729bfcbb5544f6612b7a67dd4f4d6f - () https://git.kernel.org/stable/c/bbc5d7b46a729bfcbb5544f6612b7a67dd4f4d6f - Patch
References () https://git.kernel.org/stable/c/d593e1ede655b74c42e4e4fe285ea64aee96fb5c - () https://git.kernel.org/stable/c/d593e1ede655b74c42e4e4fe285ea64aee96fb5c - Patch
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-401

02 May 2025, 13:52

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net: dsa: Se corrigen posibles fugas de memoria en dsa_loop_init() kmemleak informó de fugas de memoria en dsa_loop_init(): kmemleak: 12 nuevas fugas de memoria sospechosas objeto no referenciado 0xffff8880138ce000 (tamaño 2048): comm "modprobe", pid 390, jiffies 4295040478 (edad 238,976 s) backtrace: [&lt;000000006a94f1d5&gt;] kmalloc_trace+0x26/0x60 [&lt;00000000a9c44622&gt;] phy_device_create+0x5d/0x970 [&lt;00000000d0ee2afc&gt;] Hay dos razones para la pérdida de memoria en dsa_loop_init(). Primero, fixed_phy_register() crea y registra phy_device: fixed_phy_register() get_phy_device() phy_device_create() # liberado por phy_device_free() phy_device_register() # liberado por phy_device_remove() Pero fixed_phy_unregister() solo llama a phy_device_remove(). Por lo tanto, la memoria asignada en phy_device_create() se filtra. Segundo, cuando mdio_driver_register() falla en dsa_loop_init(), simplemente regresa y no hay limpieza para phydevs. Solucione los problemas capturando el error de mdio_driver_register() en dsa_loop_init(), luego llame a fixed_phy_unregister() y phy_device_free() para liberar phydevs. También agregue una función para la limpieza de phydevs para evitar la duplicación.

01 May 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:16

Updated : 2025-05-07 13:28

NVD link : CVE-2022-49926

Mitre link : CVE-2022-49926

CVE.ORG link : CVE-2022-49926

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime