CVE-2022-49636

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vlan: fix memory leak in vlan_newlink()

Blamed commit added back a bug I fixed in commit 9bbd917e0bec

("vlan: fix memory leak in vlan_dev_set_egress_priority")

If a memory allocation fails in vlan_changelink() after other allocations

succeeded, we need to call vlan_dev_free_egress_priority()

to free all allocated memory because after a failed ->newlink()

we do not call any methods like ndo_uninit() or dev->priv_destructor().

In following example, if the allocation for last element 2000:2001 fails,

we need to free eight prior allocations:

ip link add link dummy0 dummy0.100 type vlan id 100 \

egress-qos-map 1:2 2:3 3:4 4:5 5:6 6:7 7:8 8:9 2000:2001

syzbot report was:

BUG: memory leak

unreferenced object 0xffff888117bd1060 (size 32):

comm "syz-executor408", pid 3759, jiffies 4294956555 (age 34.090s)

hex dump (first 32 bytes):

09 00 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 ................

00 00 00 00 00 00 00 00

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References