Memory leak in Linux kernel tty driver

1) Memory leak

EUVDB-ID: #VU104270

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:U/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49399

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the goldfish_tty_probe() and goldfish_tty_remove() functions in drivers/tty/goldfish.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 5.10 - 5.10.121

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:5.10.121:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/241fcb79dd1df276d80b19f5f6acc9eaaaa63309
https://git.kernel.org/stable/c/326192b99c903a2193d820c30ed936cc2402382c
https://git.kernel.org/stable/c/45f6ce70abfb7ccf9d787781cbc4c03294a775a1
https://git.kernel.org/stable/c/4639d1b992de8f37d66f698056875c274efcd45f
https://git.kernel.org/stable/c/507b05063d1b7a1fcb9f7d7c47586fc4f3508f98
https://git.kernel.org/stable/c/9ae3d073f7db5578ae1907544f0c15947e9678e6
https://git.kernel.org/stable/c/da64f419d7f78272bfe40dde1262602d4ff6b32c
https://git.kernel.org/stable/c/ee6c33b29e624f515202a31bf6ef0437f26a1867
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.122

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.