#VU104270 Memory leak in Linux kernel - CVE-2022-49399

Vulnerability identifier: #VU104270

Vulnerability risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:U/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49399

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the goldfish_tty_probe() and goldfish_tty_remove() functions in drivers/tty/goldfish.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/241fcb79dd1df276d80b19f5f6acc9eaaaa63309
https://git.kernel.org/stable/c/326192b99c903a2193d820c30ed936cc2402382c
https://git.kernel.org/stable/c/45f6ce70abfb7ccf9d787781cbc4c03294a775a1
https://git.kernel.org/stable/c/4639d1b992de8f37d66f698056875c274efcd45f
https://git.kernel.org/stable/c/507b05063d1b7a1fcb9f7d7c47586fc4f3508f98
https://git.kernel.org/stable/c/9ae3d073f7db5578ae1907544f0c15947e9678e6
https://git.kernel.org/stable/c/da64f419d7f78272bfe40dde1262602d4ff6b32c
https://git.kernel.org/stable/c/ee6c33b29e624f515202a31bf6ef0437f26a1867

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.