Memory leak in Linux kernel usb dwc2 driver



| Updated: 2025-05-11
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2022-49713
CWE-ID CWE-401
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Linux kernel
Operating systems & Components / Operating system

Vendor Linux Foundation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Memory leak

EUVDB-ID: #VU104347

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49713

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the dwc2_hcd_init() function in drivers/usb/dwc2/hcd.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 5.10 - 5.10.123

CPE2.3 External links

https://git.kernel.org/stable/c/3755278f078460b021cd0384562977bf2039a57a
https://git.kernel.org/stable/c/52bfcedbfd5bf962dbdcb6e761f4d0dd3ba26dfd
https://git.kernel.org/stable/c/6506aff2dc2f7059aa3d45ee2e8639b25e87090f
https://git.kernel.org/stable/c/701d8ec01e0f229d4db6f43d3d64ee479120cbeb
https://git.kernel.org/stable/c/84e6d0af87e27bbc0db94f2e7323b34abe17b6e5
https://git.kernel.org/stable/c/981ee40649e5fd9550f82db1fbb3bfab037da346
https://git.kernel.org/stable/c/a44a8a762f7fe9ad3c065813d058e835a6180cb2
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.124


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###