5.5
CVE-2022-49793
- EPSS 0.19%
- Veröffentlicht 01.05.2025 14:09:24
- Zuletzt bearbeitet 06.11.2025 22:07:22
- Quelle 416baaa9-dc9f-4396-8d5f-8c081f
- CVE-Watchlists
- Unerledigt
iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()
In the Linux kernel, the following vulnerability has been resolved:
iio: trigger: sysfs: fix possible memory leak in iio_sysfs_trig_init()
dev_set_name() allocates memory for name, it need be freed
when device_add() fails, call put_device() to give up the
reference that hold in device_initialize(), so that it can
be freed in kobject_cleanup() when the refcount hit to 0.
Fault injection test can trigger this:
unreferenced object 0xffff8e8340a7b4c0 (size 32):
comm "modprobe", pid 243, jiffies 4294678145 (age 48.845s)
hex dump (first 32 bytes):
69 69 6f 5f 73 79 73 66 73 5f 74 72 69 67 67 65 iio_sysfs_trigge
72 00 a7 40 83 8e ff ff 00 86 13 c4 f6 ee ff ff r..@............
backtrace:
[<0000000074999de8>] __kmem_cache_alloc_node+0x1e9/0x360
[<00000000497fd30b>] __kmalloc_node_track_caller+0x44/0x1a0
[<000000003636c520>] kstrdup+0x2d/0x60
[<0000000032f84da2>] kobject_set_name_vargs+0x1e/0x90
[<0000000092efe493>] dev_set_name+0x4e/0x70Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 3.0 < 4.9.334
Linux ≫ Linux Kernel Version >= 4.10 < 4.14.300
Linux ≫ Linux Kernel Version >= 4.15 < 4.19.267
Linux ≫ Linux Kernel Version >= 4.20 < 5.4.225
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.156
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.80
Linux ≫ Linux Kernel Version >= 5.16 < 6.0.10
Linux ≫ Linux Kernel Version6.1 Updaterc1
Linux ≫ Linux Kernel Version6.1 Updaterc2
Linux ≫ Linux Kernel Version6.1 Updaterc3
Linux ≫ Linux Kernel Version6.1 Updaterc4
Linux ≫ Linux Kernel Version6.1 Updaterc5
VulnDex Vulnerability Enrichment
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.19% | 0.086 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
|
CWE-401 Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
https://git.kernel.org/stable/c/f68c96821b61d2c71a35dbb8bf90c347fad624d9
https://git.kernel.org/stable/c/5a39382aa5411d64b25a71516c2c7480aab13bb7
https://git.kernel.org/stable/c/b47bb521961f027b4dcf8683337a7a1ba9e5ea1f
https://git.kernel.org/stable/c/0dd52e141afde089304de470148d311b05c14564
https://git.kernel.org/stable/c/8dddf2699da296c84205582aaead6b43dd7e8c4b
https://git.kernel.org/stable/c/656f670613662b6cc77aad14112db2803ad18fa8
https://git.kernel.org/stable/c/2c4e65285bdea23fd36d2ff376006ac64db6f42e
https://git.kernel.org/stable/c/efa17e90e1711bdb084e3954fa44afb6647331c0