CVE-2022-49741

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fbdev: smscufx: fix error handling code in ufx_usb_probe

The current error handling code in ufx_usb_probe have many unmatching

issues, e.g., missing ufx_free_usb_list, destroy_modedb label should

only include framebuffer_release, fb_dealloc_cmap only matches

fb_alloc_cmap.

My local syzkaller reports a memory leak bug:

memory leak in ufx_usb_probe

BUG: memory leak

unreferenced object 0xffff88802f879580 (size 128):

comm "kworker/0:7", pid 17416, jiffies 4295067474 (age 46.710s)

hex dump (first 32 bytes):

80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff .!|.............

00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00 ................

backtrace:

[<ffffffff814c99a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045

[<ffffffff824d219c>] kmalloc include/linux/slab.h:553 [inline]

[<ffffffff824d219c>] kzalloc include/linux/slab.h:689 [inline]

[<ffffffff824d219c>] ufx_alloc_urb_list drivers/video

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References