CVE-2022-49389

Summary

In the Linux kernel, the following vulnerability has been resolved:

usb: usbip: fix a refcount leak in stub_probe()

usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails after that, usb_put_dev() needs to be called to release the reference.

Fix this by moving usb_put_dev() to sdev_free error path handling.

Find this by code review.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux3ff67445750a84de67faaf52c6e1895cb09f2c56 < 6bafee2f18af5e5ac125e42960bc65496d0e56a0affected
LinuxLinux3ff67445750a84de67faaf52c6e1895cb09f2c56 < f20d2d3b3364ce6525c050a8b6b4c54c8c19674daffected
LinuxLinux3ff67445750a84de67faaf52c6e1895cb09f2c56 < 247d3809e45a34d9e1a3a2bb7012e31ed8b46031affected
LinuxLinux3ff67445750a84de67faaf52c6e1895cb09f2c56 < 2f0ae93ec33c8456cdfbf7876b80403a6318ebceaffected
LinuxLinux3ff67445750a84de67faaf52c6e1895cb09f2c56 < bcbb795a9e78180d74c6ab21518da87e803dfdceaffected
LinuxLinux3ff67445750a84de67faaf52c6e1895cb09f2c56 < 51422046be504515eb5a591adf0f424b62f46804affected
LinuxLinux3ff67445750a84de67faaf52c6e1895cb09f2c56 < 8afb048800919d0ab10c57983940eba956339f21affected
LinuxLinux3ff67445750a84de67faaf52c6e1895cb09f2c56 < 11c65408bd0ba1d9cd1307caa38169292de9cdfbaffected
LinuxLinux3ff67445750a84de67faaf52c6e1895cb09f2c56 < 9ec4cbf1cc55d126759051acfe328d489c5d6e60affected
LinuxLinux77e7f91231bf63e3c64eb59a2aaf5754eaea2e69affected
LinuxLinuxd0f35e23dafa0185f979d0c70463caa658062264affected
LinuxLinux3.16.58 < 3.17affected
LinuxLinux3.18.110 < 3.19affected
LinuxLinux3.19affected
LinuxLinux0 < 3.19unaffected
LinuxLinux4.9.318 <= 4.9.*unaffected
LinuxLinux4.14.283 <= 4.14.*unaffected
LinuxLinux4.19.247 <= 4.19.*unaffected
LinuxLinux5.4.198 <= 5.4.*unaffected
LinuxLinux5.10.122 <= 5.10.*unaffected
LinuxLinux5.15.47 <= 5.15.*unaffected
LinuxLinux5.17.15 <= 5.17.*unaffected
LinuxLinux5.18.4 <= 5.18.*unaffected
LinuxLinux5.19 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References