CVE-2022-50702

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blk_init()

Inject fault while probing module, if device_register() fails in

vdpasim_net_init() or vdpasim_blk_init(), but the refcount of kobject is

not decreased to 0, the name allocated in dev_set_name() is leaked.

Fix this by calling put_device(), so that name can be freed in

callback function kobject_cleanup().

(vdpa_sim_net)

unreferenced object 0xffff88807eebc370 (size 16):

comm "modprobe", pid 3848, jiffies 4362982860 (age 18.153s)

hex dump (first 16 bytes):

76 64 70 61 73 69 6d 5f 6e 65 74 00 6b 6b 6b a5 vdpasim_net.kkk.

backtrace:

[<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150

[<ffffffff81731d53>] kstrdup+0x33/0x60

[<ffffffff83a5d421>] kobject_set_name_vargs+0x41/0x110

[<ffffffff82d87aab>] dev_set_name+0xab/0xe0

[<ffffffff82d91a23>] device_add+0xe3/0x1a80

[<ffffffffa0270013>] 0xffffffffa027001

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References