Memory leak in Linux kernel core

1) Memory leak

EUVDB-ID: #VU104394

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49209

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the sk_msg_alloc() function in net/core/skmsg.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/6d03722c34d9603df325f67c6d30dc1b7b3c6067
https://git.kernel.org/stable/c/9c34e38c4a870eb30b13f42f5b44f42e9d19ccb8
https://git.kernel.org/stable/c/bec34a91eba3483e1830c02bdd36f8f968642047
https://git.kernel.org/stable/c/d0b85dfc6f01d26808e2576c6537c131b590e270
https://git.kernel.org/stable/c/de3a8d8fab0710186f7864ec812836d8d70da3c9
https://git.kernel.org/stable/c/f677328f05f52d535cbdc15cb04476db49477eb4

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.