CVE-2022-48995

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48995
In the Linux kernel, the following vulnerability has been resolved: Input: raydium_ts_i2c - fix memory leak in raydium_i2c_send() There is a kmemleak when test the raydium_i2c_ts with bpf mock device: unreferenced object 0xffff88812d3675a0 (size 8): comm "python3", pid 349, jiffies 4294741067 (age 95.695s) hex dump (first 8 bytes): 11 0e 10 c0 01 00 04 00 ........ backtrace: [<0000000068427125>] __kmalloc+0x46/0x1b0 [<0000000090180f91>] raydium_i2c_send+0xd4/0x2bf [raydium_i2c_ts] [<000000006e631aee>] raydium_i2c_initialize.cold+0xbc/0x3e4 [raydium_i2c_ts] [<00000000dc6fcf38>] raydium_i2c_probe+0x3cd/0x6bc [raydium_i2c_ts] [<00000000a310de16>] i2c_device_probe+0x651/0x680 [<00000000f5a96bf3>] really_probe+0x17c/0x3f0 [<00000000096ba499>] __driver_probe_device+0xe3/0x170 [<00000000c5acb4d9>] driver_probe_device+0x49/0x120 [<00000000264fe082>] __device_attach_driver+0xf7/0x150 [<00000000f919423c>] bus_for_each_drv+0x114/0x180 [<00000000e067feca>] __device_attach+0x1e5/0x2d0 [<0000000054301fc2>] bus_probe_device+0x126/0x140 [<00000000aad93b22>] device_add+0x810/0x1130 [<00000000c086a53f>] i2c_new_client_device+0x352/0x4e0 [<000000003c2c248c>] of_i2c_register_device+0xf1/0x110 [<00000000ffec4177>] of_i2c_notify+0x100/0x160 unreferenced object 0xffff88812d3675c8 (size 8): comm "python3", pid 349, jiffies 4294741070 (age 95.692s) hex dump (first 8 bytes): 22 00 36 2d 81 88 ff ff ".6-.... backtrace: [<0000000068427125>] __kmalloc+0x46/0x1b0 [<0000000090180f91>] raydium_i2c_send+0xd4/0x2bf [raydium_i2c_ts] [<000000001d5c9620>] raydium_i2c_initialize.cold+0x223/0x3e4 [raydium_i2c_ts] [<00000000dc6fcf38>] raydium_i2c_probe+0x3cd/0x6bc [raydium_i2c_ts] [<00000000a310de16>] i2c_device_probe+0x651/0x680 [<00000000f5a96bf3>] really_probe+0x17c/0x3f0 [<00000000096ba499>] __driver_probe_device+0xe3/0x170 [<00000000c5acb4d9>] driver_probe_device+0x49/0x120 [<00000000264fe082>] __device_attach_driver+0xf7/0x150 [<00000000f919423c>] bus_for_each_drv+0x114/0x180 [<00000000e067feca>] __device_attach+0x1e5/0x2d0 [<0000000054301fc2>] bus_probe_device+0x126/0x140 [<00000000aad93b22>] device_add+0x810/0x1130 [<00000000c086a53f>] i2c_new_client_device+0x352/0x4e0 [<000000003c2c248c>] of_i2c_register_device+0xf1/0x110 [<00000000ffec4177>] of_i2c_notify+0x100/0x160 After BANK_SWITCH command from i2c BUS, no matter success or error happened, the tx_buf should be freed.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/097c1c7a28e3da8f2811ba532be6e81faab15aab Patch
https://git.kernel.org/stable/c/53b9b1201e34ccc895971218559123625c56fbcd Patch
https://git.kernel.org/stable/c/8c9a59939deb4bfafdc451100c03d1e848b4169b Patch
https://git.kernel.org/stable/c/a82869ac52f3d9db4b2cf8fd41edc2dee7a75a61 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*
History

25 Oct 2024, 15:52

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/097c1c7a28e3da8f2811ba532be6e81faab15aab - () https://git.kernel.org/stable/c/097c1c7a28e3da8f2811ba532be6e81faab15aab - Patch
References () https://git.kernel.org/stable/c/53b9b1201e34ccc895971218559123625c56fbcd - () https://git.kernel.org/stable/c/53b9b1201e34ccc895971218559123625c56fbcd - Patch
References () https://git.kernel.org/stable/c/8c9a59939deb4bfafdc451100c03d1e848b4169b - () https://git.kernel.org/stable/c/8c9a59939deb4bfafdc451100c03d1e848b4169b - Patch
References () https://git.kernel.org/stable/c/a82869ac52f3d9db4b2cf8fd41edc2dee7a75a61 - () https://git.kernel.org/stable/c/a82869ac52f3d9db4b2cf8fd41edc2dee7a75a61 - Patch
CWE CWE-401
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*

23 Oct 2024, 15:13

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: Entrada: raydium_ts_i2c - arregla pérdida de memoria en raydium_i2c_send() Hay una pérdida de kmem cuando se prueba raydium_i2c_ts con bpf mock device: unreferenced object 0xffff88812d3675a0 (size 8): comm "python3", pid 349, jiffies 4294741067 (age 95.695s) hex dump (first 8 bytes): 11 0e 10 c0 01 00 04 00 ........ backtrace: [&lt;0000000068427125&gt;] __kmalloc+0x46/0x1b0 [&lt;0000000090180f91&gt;] raydium_i2c_send+0xd4/0x2bf [raydium_i2c_ts] [&lt;000000006e631aee&gt;] raydium_i2c_initialize.cold+0xbc/0x3e4 [raydium_i2c_ts] [&lt;00000000dc6fcf38&gt;] raydium_i2c_probe+0x3cd/0x6bc [raydium_i2c_ts] [&lt;00000000a310de16&gt;] i2c_device_probe+0x651/0x680 [&lt;00000000f5a96bf3&gt;] really_probe+0x17c/0x3f0 [&lt;00000000096ba499&gt;] __driver_probe_device+0xe3/0x170 [&lt;00000000c5acb4d9&gt;] dispositivo_de_sonda_de_controlador+0x49/0x120 [&lt;00000000264fe082&gt;] __controlador_de_adjuntar_dispositivo+0xf7/0x150 [&lt;00000000f919423c&gt;] bus_para_cada_unidad+0x114/0x180 [&lt;00000000e067feca&gt;] __adjuntar_dispositivo+0x1e5/0x2d0 [&lt;0000000054301fc2&gt;] dispositivo_de_sonda_de_bus+0x126/0x140 [&lt;00000000aad93b22&gt;] dispositivo_agregar+0x810/0x1130 [&lt;00000000c086a53f&gt;] i2c_new_client_device+0x352/0x4e0 [&lt;000000003c2c248c&gt;] of_i2c_register_device+0xf1/0x110 [&lt;00000000ffec4177&gt;] of_i2c_notify+0x100/0x160 objeto sin referencia 0xffff88812d3675c8 (tamaño 8): comm "python3", pid 349, jiffies 4294741070 (antigüedad 95,692 s) volcado hexadecimal (primeros 8 bytes): 22 00 36 2d 81 88 ff ff ".6-.... traza inversa: [&lt;0000000068427125&gt;] __kmalloc+0x46/0x1b0 [&lt;0000000090180f91&gt;] raydium_i2c_send+0xd4/0x2bf [raydium_i2c_ts] [&lt;000000001d5c9620&gt;] raydium_i2c_initialize.cold+0x223/0x3e4 [raydium_i2c_ts] [&lt;00000000dc6fcf38&gt;] raydium_i2c_probe+0x3cd/0x6bc [raydium_i2c_ts] [&lt;00000000a310de16&gt;] i2c_device_probe+0x651/0x680 [&lt;00000000f5a96bf3&gt;] realmente_sondeo+0x17c/0x3f0 [&lt;00000000096ba499&gt;] __dispositivo_de_sonda_de_controlador+0xe3/0x170 [&lt;00000000c5acb4d9&gt;] dispositivo_de_sonda_de_controlador+0x49/0x120 [&lt;00000000264fe082&gt;] __dispositivo_adjunto_controlador+0xf7/0x150 [&lt;00000000f919423c&gt;] bus_para_cada_unidad+0x114/0x180 [&lt;00000000e067feca&gt;] __dispositivo_adjunto+0x1e5/0x2d0 [&lt;0000000054301fc2&gt;] bus_probe_device+0x126/0x140 [&lt;00000000aad93b22&gt;] device_add+0x810/0x1130 [&lt;00000000c086a53f&gt;] i2c_new_client_device+0x352/0x4e0 [&lt;000000003c2c248c&gt;] of_i2c_register_device+0xf1/0x110 [&lt;00000000ffec4177&gt;] of_i2c_notify+0x100/0x160 Después del comando BANK_SWITCH del BUS i2c, sin importar si se produjo un éxito o un error, se debe liberar el tx_buf.

21 Oct 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-21 20:15

Updated : 2024-10-25 15:52

NVD link : CVE-2022-48995

Mitre link : CVE-2022-48995

CVE.ORG link : CVE-2022-48995

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime


NetmanageIT Website NetmanageIT OSINT Web NetmanageIT OpenCTI NetmanageIT PDF Tools NetmanageIT CTO Corner Blog NetmanageIT Email Header Analyzer NetmanageIT Password Pusher NetmanageIT Internet Health and Latency Dashboard NetmanageIT Dedicated Speed Test Site NetmanageIT Ubuntu Mirror 10Gbps Copyright OpenCVE 2024