CVE-2022-50042

Description

In the Linux kernel, the following vulnerability has been resolved: net: genl: fix error path memory leak in policy dumping If construction of the array of policies fails when recording non-first policy we need to unwind. netlink_policy_dump_add_policy() itself also needs fixing as it currently gives up on error without recording the allocated pointer in the pstate pointer.

CVSS Metrics

• v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.07%• Percentile: 20%

Techniques & Countermeasures

• CWE-401•Missing Release of Memory after Effective Lifetime

  The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

Affected Systems

• linux•linux

  ≥ 50a896cf2d6f34e884a00139d6e6012c9833ace3, < 83411c9f05d5a8b637293b3389eca3d378197c04 | ≥ 50a896cf2d6f34e884a00139d6e6012c9833ace3, < b0672895d8be5d19d4b05ac83f807026fc791037 | ≥ 50a896cf2d6f34e884a00139d6e6012c9833ace3, < 26b6acd365823e99e46be3b27500f5dc235dda5e | ≥ 50a896cf2d6f34e884a00139d6e6012c9833ace3, < 249801360db3dec4f73768c502192020bfddeacc | 5.10

• linux•linux_kernel

  ≥ 5.10, < 5.10.138 | ≥ 5.11, < 5.15.63 | ≥ 5.16, < 5.19.4 | 6.0:rc1

References (4)

• https://git.kernel.org/stable/c/83411c9f05d5a8b637293b3389eca3d378197c04
• https://git.kernel.org/stable/c/b0672895d8be5d19d4b05ac83f807026fc791037
• https://git.kernel.org/stable/c/26b6acd365823e99e46be3b27500f5dc235dda5e
• https://git.kernel.org/stable/c/249801360db3dec4f73768c502192020bfddeacc