Memory leak in Linux kernel - CVE-2022-27950

Vulnerability identifier: #VU69123

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-27950

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform DoS attack on the target system.

The vulnerability exists due memory leak within the drivers/hid/hid-elo.c in the Linux kernel. A local user can perform denial of service attack.

Linux kernel
Oracle Linux
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for ARM 64
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Real Time for NFV
Red Hat Enterprise Linux for Real Time
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat CodeReady Linux Builder for x86_64 - Extended Update Support
Red Hat CodeReady Linux Builder for Power, little endian - Extended Update Support
Red Hat CodeReady Linux Builder for ARM 64 - Extended Update Support
Red Hat OpenShift Container Platform
OpenShift Logging
Red Hat Advanced Cluster Management for Kubernetes
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
kernel (Red Hat package)
kernel-rt (Red Hat package)

Install updates from vendor's website.

Linux kernel - update to 5.16.11
Red Hat OpenShift Container Platform - update to 4.15.3
OpenShift Logging - addressed in versions 5.3.14, 5.5.5
Red Hat Advanced Cluster Management for Kubernetes - update to 2.6.3
kernel (Red Hat package) - addressed in versions 4.18.0-372.95.1.el8_6, 4.18.0-425.3.1.el8
kernel-rt (Red Hat package) - update to 4.18.0-425.3.1.rt7.213.el8

• https://www.openwall.com/lists/oss-security/2022/03/13/1
• https://github.com/torvalds/linux/commit/817b8b9c5396d2b2d92311b46719aad5d3339dbe
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.11
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=817b8b9c5396d2b2d92311b46719aad5d3339dbe

• Memory leak in Linux kernel hid driver
• Red Hat Enterprise Linux 8 update for kernel
• Red Hat Enterprise Linux 8 update for kernel-rt
• Multiple vulnerabilities in Openshift Logging 5.3
• Multiple vulnerabilities in OpenShift Logging 5.5
• Multiple vulnerabilities in Oracle Linux
• Red Hat Enterprise Linux 8.6 Extended Update Support update for kernel
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.15
• Multiple vulnerabilities in Red Hat Advanced Cluster Management for Kubernetes 2.6