Memory leak in Linux kernel

1) Memory leak

EUVDB-ID: #VU108146

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49861

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the mv_xor_v2_remove() function in drivers/dma/mv_xor_v2.c. A local user can perform a denial of service attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/04f2cc56d80a1ac058045a7835c5bfd910f17863
https://git.kernel.org/stable/c/081195d17a0c4c636da2b869bd5809d42e8cbb13
https://git.kernel.org/stable/c/0b7ee3d50f32d277bf024b4ddb4de54da43a3025
https://git.kernel.org/stable/c/1d84887327659c58a6637060ac8c50c3a952a163
https://git.kernel.org/stable/c/20479886b40c0ed4864a5fc8490a1f6b70cccf1b
https://git.kernel.org/stable/c/4b6641c3a2ba95ddcfecec263b4a5e572a4b0641
https://git.kernel.org/stable/c/992e966caf57e00855edbd79f19d911809732a69
https://git.kernel.org/stable/c/a1cb72e20a64a3c83f9b4ee993fbf97e4c1d7714

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.