CVE-2022-49836

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49836
In the Linux kernel, the following vulnerability has been resolved: siox: fix possible memory leak in siox_device_add() If device_register() returns error in siox_device_add(), the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(), and sdevice is freed in siox_device_release(), set it to null in error path.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0a5da069603ecc3d7aa09167450235462adaa295 Patch
https://git.kernel.org/stable/c/5d03c2911c529ea4d6ebfec53425f1091e8d402b Patch
https://git.kernel.org/stable/c/6e63153db50059fb78b8a8447b132664887d24e3 Patch
https://git.kernel.org/stable/c/a4b5423f88a17a36550ae8c16c46779b1ee42f4b Patch
https://git.kernel.org/stable/c/d9c31e728843259209fb530c59995e4fe262699f Patch
https://git.kernel.org/stable/c/f9fe7ba4ea5b24ffdf8e125f660aca3ba4a147fb Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*
History

10 Nov 2025, 21:13

Type Values Removed Values Added
CWE CWE-401
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/0a5da069603ecc3d7aa09167450235462adaa295 - () https://git.kernel.org/stable/c/0a5da069603ecc3d7aa09167450235462adaa295 - Patch
References () https://git.kernel.org/stable/c/5d03c2911c529ea4d6ebfec53425f1091e8d402b - () https://git.kernel.org/stable/c/5d03c2911c529ea4d6ebfec53425f1091e8d402b - Patch
References () https://git.kernel.org/stable/c/6e63153db50059fb78b8a8447b132664887d24e3 - () https://git.kernel.org/stable/c/6e63153db50059fb78b8a8447b132664887d24e3 - Patch
References () https://git.kernel.org/stable/c/a4b5423f88a17a36550ae8c16c46779b1ee42f4b - () https://git.kernel.org/stable/c/a4b5423f88a17a36550ae8c16c46779b1ee42f4b - Patch
References () https://git.kernel.org/stable/c/d9c31e728843259209fb530c59995e4fe262699f - () https://git.kernel.org/stable/c/d9c31e728843259209fb530c59995e4fe262699f - Patch
References () https://git.kernel.org/stable/c/f9fe7ba4ea5b24ffdf8e125f660aca3ba4a147fb - () https://git.kernel.org/stable/c/f9fe7ba4ea5b24ffdf8e125f660aca3ba4a147fb - Patch

02 May 2025, 13:53

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: siox: Se corrige una posible fuga de memoria en siox_device_add(). Si device_register() devuelve un error en siox_device_add(), se debe liberar el nombre asignado por dev_set_name(). Como se indica en el comentario de device_register(), se debe usar put_device() para liberar la referencia en la ruta de error. Para solucionar esto, se debe llamar a put_device(); de esta manera, se puede liberar el nombre en kobject_cleanup() y sdevice se libera en siox_device_release(); configúrelo como nulo en la ruta de error.

01 May 2025, 15:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 15:16

Updated : 2025-11-10 21:13

NVD link : CVE-2022-49836

Mitre link : CVE-2022-49836

CVE.ORG link : CVE-2022-49836

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime