#VU104335 Memory leak in Linux kernel - CVE-2022-49678

Vulnerability identifier: #VU104335

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49678

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the brcmstb_pm_probe() function in drivers/soc/bcm/brcmstb/pm/pm-arm.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/10ba9d499a9fd82ed40897e734ba19870a879407
https://git.kernel.org/stable/c/30bbfeb480ae8b5ee43199d72417b232590440c2
https://git.kernel.org/stable/c/37d838de369b07b596c19ff3662bf0293fdb09ee
https://git.kernel.org/stable/c/4f5877bdf7b593e988f1924f4c3df6523f80b39c
https://git.kernel.org/stable/c/734a4d15142bb4c8ecad2d8ec70d7564e78ae34d
https://git.kernel.org/stable/c/dcafd5463d8f20c4f90ddc138a5738adb99f74c8

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.