CVE-2022-49830

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/drv: Fix potential memory leak in drm_dev_init()

drm_dev_init() will add drm_dev_init_release() as a callback. When

drmm_add_action() failed, the release function won't be added. As the

result, the ref cnt added by device_get() in drm_dev_init() won't be put

by drm_dev_init_release(), which leads to the memleak. Use

drmm_add_action_or_reset() instead of drmm_add_action() to prevent

memleak.

unreferenced object 0xffff88810bc0c800 (size 2048):

comm "modprobe", pid 8322, jiffies 4305809845 (age 15.292s)

hex dump (first 32 bytes):

e8 cc c0 0b 81 88 ff ff ff ff ff ff 00 00 00 00 ................

20 24 3c 0c 81 88 ff ff 18 c8 c0 0b 81 88 ff ff $<.............

backtrace:

[<000000007251f72d>] __kmalloc+0x4b/0x1c0

[<0000000045f21f26>] platform_device_alloc+0x2d/0xe0

[<000000004452a479>] platform_device_register_full+0x24/0x1c0

[<0000000089f4ea61>] 0xffffffffa0736051

[<00000000235b2441

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References