CVE-2022-48973: gpio: amd8111: Fix PCI device reference count leak
In the Linux kernel, the following vulnerability has been resolved:
gpio: amd8111: Fix PCI device reference count leak
foreachpcidev() is implemented by pcigetdevice(). The comment of pcigetdevice() says that it will increase the reference count for the returned pcidev and also decrease the reference count for the input pcidev @from if it is not NULL.
If we break foreachpcidev() loop with pdev not NULL, we need to call pcidevput() to decrease the reference count. Add the missing pcidevput() after the 'out' label. Since pcidevput() can handle NULL input parameter, there is no problem for the 'Device not found' branch. For the normal path, add pcidevput() in amdgpioexit().
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48973?
CVE-2022-48973 has a moderate severity rating due to the potential for a PCI device reference count leak.
How do I fix CVE-2022-48973?
To fix CVE-2022-48973, you should update to the latest patched version of the Linux kernel that addresses this vulnerability.
What versions are affected by CVE-2022-48973?
CVE-2022-48973 affects multiple Linux kernel versions between 3.6 and 6.1 inclusive, except those patched for this vulnerability.
What kind of systems are at risk from CVE-2022-48973?
Systems running vulnerable versions of the Linux kernel are at risk from CVE-2022-48973, specifically those utilizing amd8111 GPIO.
Is there a workaround for CVE-2022-48973?
Currently, applying a patch to upgrade the affected Linux kernel version is the recommended solution for CVE-2022-48973.