CVE-2022-49780

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49780
In the Linux kernel, the following vulnerability has been resolved: scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() If device_register() fails in tcm_loop_setup_hba_bus(), the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(). The 'tl_hba' will be freed in tcm_loop_release_adapter(), so it don't need goto error label in this case.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/28f7ff5e7559d226e63c7c5de74eb075a83d8c53 Patch
https://git.kernel.org/stable/c/41a6b8b527a5957fab41c3c05e25ad125268e2e9 Patch
https://git.kernel.org/stable/c/75205f1b47a88c3fac4f30bd7567e89b2887c7fd Patch
https://git.kernel.org/stable/c/a636772988bafab89278e7bb3420d8e8eacfe912 Patch
https://git.kernel.org/stable/c/bc68e428d4963af0201e92159629ab96948f0893 Patch
https://git.kernel.org/stable/c/dce0589a3faec9e2e543e97bca7e62592ec85585 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*
History

07 Nov 2025, 17:47

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/28f7ff5e7559d226e63c7c5de74eb075a83d8c53 - () https://git.kernel.org/stable/c/28f7ff5e7559d226e63c7c5de74eb075a83d8c53 - Patch
References () https://git.kernel.org/stable/c/41a6b8b527a5957fab41c3c05e25ad125268e2e9 - () https://git.kernel.org/stable/c/41a6b8b527a5957fab41c3c05e25ad125268e2e9 - Patch
References () https://git.kernel.org/stable/c/75205f1b47a88c3fac4f30bd7567e89b2887c7fd - () https://git.kernel.org/stable/c/75205f1b47a88c3fac4f30bd7567e89b2887c7fd - Patch
References () https://git.kernel.org/stable/c/a636772988bafab89278e7bb3420d8e8eacfe912 - () https://git.kernel.org/stable/c/a636772988bafab89278e7bb3420d8e8eacfe912 - Patch
References () https://git.kernel.org/stable/c/bc68e428d4963af0201e92159629ab96948f0893 - () https://git.kernel.org/stable/c/bc68e428d4963af0201e92159629ab96948f0893 - Patch
References () https://git.kernel.org/stable/c/dce0589a3faec9e2e543e97bca7e62592ec85585 - () https://git.kernel.org/stable/c/dce0589a3faec9e2e543e97bca7e62592ec85585 - Patch
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: target: tcm_loop: Se corrige una posible fuga de nombre en tcm_loop_setup_hba_bus(). Si device_register() falla en tcm_loop_setup_hba_bus(), se debe liberar el nombre asignado por dev_set_name(). Como se indica en el comentario de device_register(), se debe usar put_device() para liberar la referencia en la ruta de error. Para solucionar esto, se debe llamar a put_device(); luego, el nombre se puede liberar en kobject_cleanup(). El 'tl_hba' se liberará en tcm_loop_release_adapter(), por lo que no es necesario ir a la etiqueta de error en este caso.
First Time Linux
Linux linux Kernel
CWE CWE-401
CPE cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

01 May 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:16

Updated : 2025-11-07 17:47

NVD link : CVE-2022-49780

Mitre link : CVE-2022-49780

CVE.ORG link : CVE-2022-49780

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime