CVE-2022-49144

Summary

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix memory leak of uid in files registration

When there are no files for __io_sqe_files_scm() to process in the range, it'll free everything and return. However, it forgets to put uid.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux08a451739a9b5783f67de51e84cb6d9559bb9dc4 < b27de7011cb3ba14b047be2cee0ed8278368665baffected
LinuxLinux08a451739a9b5783f67de51e84cb6d9559bb9dc4 < 0853bd6885c2f293d88aaa7f7f1702c959b31680affected
LinuxLinux08a451739a9b5783f67de51e84cb6d9559bb9dc4 < d6d7a517e81accf6ed22d55684baea763d2dbe43affected
LinuxLinux08a451739a9b5783f67de51e84cb6d9559bb9dc4 < 7fa8b228c3f30060b9f4b24bb9aaaf41b0ae83feaffected
LinuxLinux08a451739a9b5783f67de51e84cb6d9559bb9dc4 < c86d18f4aa93e0e66cda0e55827cd03eea6bc5f8affected
LinuxLinux5.5affected
LinuxLinux0 < 5.5unaffected
LinuxLinux5.10.110 <= 5.10.*unaffected
LinuxLinux5.15.33 <= 5.15.*unaffected
LinuxLinux5.16.19 <= 5.16.*unaffected
LinuxLinux5.17.2 <= 5.17.*unaffected
LinuxLinux5.18 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References