Resource management error in Linux kernel devfreq driver

1) Resource management error

EUVDB-ID: #VU104897

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49460

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the rk3399_dmcfreq_remove() function in drivers/devfreq/rk3399_dmc.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/2fccf9e6050e0e3b8b4cd275d41daf7f7fa22804
https://git.kernel.org/stable/c/664736e2cc09e504ce58ec61164d029d1f2651bb
https://git.kernel.org/stable/c/86b091b6894c449d2734de7aa7d79ccb33ffd97d
https://git.kernel.org/stable/c/a0180e324a9a63de8f770da300477b48cb4a53f1
https://git.kernel.org/stable/c/a9c2b23a7ac6ab19214cad8cac8af8608a4d9cef
https://git.kernel.org/stable/c/cb1be1d4be18fe286ba5a67d928598378fd7fbe5
https://git.kernel.org/stable/c/fb089b6f21de03a685dd31df3789bbb01c59f8e3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.