#VU104352 Memory leak in Linux kernel - CVE-2022-49719

Vulnerability identifier: #VU104352

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49719

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the realview_gic_of_init() function in drivers/irqchip/irq-gic-realview.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/16b603cb8d34c2d917983918db1f88c8b831baaa
https://git.kernel.org/stable/c/486f68f85085d9b16ae097679b1486dcb1b6eb69
https://git.kernel.org/stable/c/56526c3883fc7a1f5898b1d40a02c8b8685a5d92
https://git.kernel.org/stable/c/5d38720661a4b9c87705c206a6081177ffb8ec1d
https://git.kernel.org/stable/c/87da903ce632d5689bef66d56ee5dae700d82104
https://git.kernel.org/stable/c/b634af84bc1edece4e63317b0ad95618dd3a8693
https://git.kernel.org/stable/c/e52a58b79f11755ea7e877015c4a1704303fa55f
https://git.kernel.org/stable/c/f4b98e314888cc51486421bcf6d52852452ea48b

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.