CVE-2022-49661

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

can: gs_usb: gs_usb_open/close(): fix memory leak

The gs_usb driver appears to suffer from a malady common to many USB

CAN adapter drivers in that it performs usb_alloc_coherent() to

allocate a number of USB request blocks (URBs) for RX, and then later

relies on usb_kill_anchored_urbs() to free them, but this doesn't

actually free them. As a result, this may be leaking DMA memory that's

been used by the driver.

This commit is an adaptation of the techniques found in the esd_usb2

driver where a similar design pattern led to a memory leak. It

explicitly frees the RX URBs and their DMA memory via a call to

usb_free_coherent(). Since the RX URBs were allocated in the

gs_can_open(), we remove them in gs_can_close() rather than in the

disconnect function as was done in esd_usb2.

For more information, see the 928150fad41b ("can: esd_usb2: fix memory

leak").

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References