#VU104324 Memory leak in Linux kernel - CVE-2022-49652

Vulnerability identifier: #VU104324

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49652

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the ti_dra7_xbar_route_allocate() function in drivers/dma/ti/dma-crossbar.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/37147e22cd8dfc0412495cb361708836157a4486
https://git.kernel.org/stable/c/3bd66010398871807c1cebacee07d60ded1b1402
https://git.kernel.org/stable/c/452b9dfd7aca96befce22634fadb111737f22bbe
https://git.kernel.org/stable/c/61b4ef19c346dc21ab1d4f39f5c412e3037b2bdc
https://git.kernel.org/stable/c/b31ab132561c7f1b6459039152b8d09e44eb3565
https://git.kernel.org/stable/c/b5a817f8d62e9e13280928f3756e54854ae4962e
https://git.kernel.org/stable/c/c132fe78ad7b4ce8b5d49a501a15c29d08eeb23a
https://git.kernel.org/stable/c/cb9813d7eae917acd34436160a278b8b5d48ca53

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.