CVE-2022-3624: linux kernel Improper Resource Shutdown or Release

Vulnerability summary

CVE-2022-3624 is a low (CVSS 3.5) Improper Resource Shutdown or Release vulnerability in linux kernel. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 18.2% of scored vulnerabilities.

Timeline

1. 21-10-2022
   PublishedVulnerability first disclosed.
2. 15-04-2025
   Last modifiedVulnerability information updated.

Description

A vulnerability was found in Linux Kernel and classified as problematic. Affected by this issue is the function rlb_arp_xmit of the file drivers/net/bonding/bond_alb.c of the component IPsec. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211928.

• CWE-404Improper Resource Shutdown or ReleaseThe product does not release or incorrectly releases a resource before it is made available for re-use.
• CWE-401Missing Release of Memory after Effective LifetimeThe product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.