#VU104394 Memory leak in Linux kernel - CVE-2022-49209

Vulnerability identifier: #VU104394

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49209

CWE-ID: CWE-401

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the sk_msg_alloc() function in net/core/skmsg.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 5.16, 5.16 rc1, 5.16 rc2, 5.16 rc3, 5.16 rc4, 5.16 rc5, 5.16 rc6, 5.16 rc8, 5.16.0, 5.16.1, 5.16.2, 5.16.3, 5.16.4, 5.16.5, 5.16.6, 5.16.7, 5.16.8, 5.16.9, 5.16.10, 5.16.11, 5.16.12, 5.16.13, 5.16.14, 5.16.15, 5.16.16, 5.16.17, 5.16.18

---

External links
https://git.kernel.org/stable/c/6d03722c34d9603df325f67c6d30dc1b7b3c6067
https://git.kernel.org/stable/c/9c34e38c4a870eb30b13f42f5b44f42e9d19ccb8
https://git.kernel.org/stable/c/bec34a91eba3483e1830c02bdd36f8f968642047
https://git.kernel.org/stable/c/d0b85dfc6f01d26808e2576c6537c131b590e270
https://git.kernel.org/stable/c/de3a8d8fab0710186f7864ec812836d8d70da3c9
https://git.kernel.org/stable/c/f677328f05f52d535cbdc15cb04476db49477eb4
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.19

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.