#VU104907 Resource management error in Linux kernel - CVE-2022-49259

Vulnerability identifier: #VU104907

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49259

CWE-ID: CWE-399

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the blk_unregister_queue() function in block/blk-sysfs.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/0b5924a14d64487ebd51127b0358d06066ef5384
https://git.kernel.org/stable/c/0f69288253e9fc7c495047720e523b9f1aba5712
https://git.kernel.org/stable/c/3d7e32c8da45957326f56937e0471c686d1a7711
https://git.kernel.org/stable/c/84fe3ca6e7910beb47ec13509d484f84fa2a41ad
https://git.kernel.org/stable/c/b2001eb10f59363da930cdd6e086a2861986fa18
https://git.kernel.org/stable/c/cf0cb8686e55d9c022944bc6ba9e19e832889e83
https://git.kernel.org/stable/c/efaa0e969261e97c1fdd8e0338e5dd3ba5b9219c

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.