CVE-2022-49583

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49583
In the Linux kernel, the following vulnerability has been resolved: iavf: Fix handling of dummy receive descriptors Fix memory leak caused by not handling dummy receive descriptor properly. iavf_get_rx_buffer now sets the rx_buffer return value for dummy receive descriptors. Without this patch, when the hardware writes a dummy descriptor, iavf would not free the page allocated for the previous receive buffer. This is an unlikely event but can still happen. [Jesse: massaged commit message]

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2918419c06088f6709ceb543feb01752779ade4c Patch
https://git.kernel.org/stable/c/6edb818732fc05fda495f5b3a749bd1cee01398b Patch
https://git.kernel.org/stable/c/a9f49e0060301a9bfebeca76739158d0cf91cdf6 Patch
https://git.kernel.org/stable/c/c6af94324911ef0846af1a5ce5e049ca736db34b Patch
https://git.kernel.org/stable/c/d88d59faf4e6f9cc4767664206afdb999b10ec77 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc7:*:*:*:*:*:*
History

10 Mar 2025, 20:23

Type Values Removed Values Added
CWE CWE-401
CPE cpe:2.3:o:linux:linux_kernel:5.19:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/2918419c06088f6709ceb543feb01752779ade4c - () https://git.kernel.org/stable/c/2918419c06088f6709ceb543feb01752779ade4c - Patch
References () https://git.kernel.org/stable/c/6edb818732fc05fda495f5b3a749bd1cee01398b - () https://git.kernel.org/stable/c/6edb818732fc05fda495f5b3a749bd1cee01398b - Patch
References () https://git.kernel.org/stable/c/a9f49e0060301a9bfebeca76739158d0cf91cdf6 - () https://git.kernel.org/stable/c/a9f49e0060301a9bfebeca76739158d0cf91cdf6 - Patch
References () https://git.kernel.org/stable/c/c6af94324911ef0846af1a5ce5e049ca736db34b - () https://git.kernel.org/stable/c/c6af94324911ef0846af1a5ce5e049ca736db34b - Patch
References () https://git.kernel.org/stable/c/d88d59faf4e6f9cc4767664206afdb999b10ec77 - () https://git.kernel.org/stable/c/d88d59faf4e6f9cc4767664206afdb999b10ec77 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iavf: Se corrige la gestión de descriptores de recepción ficticios Se corrige la pérdida de memoria causada por no manejar correctamente los descriptores de recepción ficticios. iavf_get_rx_buffer ahora establece el valor de retorno de rx_buffer para los descriptores de recepción ficticios. Sin este parche, cuando el hardware escribe un descriptor ficticio, iavf no liberaría la página asignada para el búfer de recepción anterior. Este es un evento poco probable, pero aún puede suceder. [Jesse: mensaje de confirmación modificado]

26 Feb 2025, 07:01

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:01

Updated : 2025-03-10 21:21

NVD link : CVE-2022-49583

Mitre link : CVE-2022-49583

CVE.ORG link : CVE-2022-49583

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime