#VU108138 Memory leak in Linux kernel - CVE-2022-49881

Vulnerability identifier: #VU108138

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49881

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the regdb_fw_cb() and query_regdb_file() functions in net/wireless/reg.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 6.0, 6.0 rc1, 6.0 rc2, 6.0 rc3, 6.0 rc4, 6.0.1, 6.0.2, 6.0.3, 6.0.4, 6.0.5, 6.0.6, 6.0.7, 6.0.8

---

External links
https://git.kernel.org/stable/c/0ede1a988299e95d54bd89551fd635980572e920
https://git.kernel.org/stable/c/219446396786330937bcd382a7bc4ccd767383bc
https://git.kernel.org/stable/c/38c9fa2cc6bf4b6e1a74057aef8b5cffd23d3264
https://git.kernel.org/stable/c/57b962e627ec0ae53d4d16d7bd1033e27e67677a
https://git.kernel.org/stable/c/e1e12180321f416d83444f2cdc9259e0f5093d35
https://git.kernel.org/stable/c/e9b5a4566d5bc71cc901be50d1fa24da00613120
https://mirrors.edge.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.0.9

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.