CVE-2022-49153: wireguard: socket: free skb in send6 when ipv6 is disabled
In the Linux kernel, the following vulnerability has been resolved:
wireguard: socket: free skb in send6 when ipv6 is disabled
I got a memory leak report:
unreferenced object 0xffff8881191fc040 (size 232): comm "kworker/u17:0", pid 23193, jiffies 4295238848 (age 3464.870s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff814c3ef4>] slabpostallochook+0x84/0x3b0 [<ffffffff814c8977>] kmemcacheallocnode+0x167/0x340 [<ffffffff832974fb>] allocskb+0x1db/0x200 [<ffffffff82612b5d>] wgsocketsendbuffertopeer+0x3d/0xc0 [<ffffffff8260e94a>] wgpacketsendhandshakeinitiation+0xfa/0x110 [<ffffffff8260ec81>] wgpackethandshakesendworker+0x21/0x30 [<ffffffff8119c558>] processonework+0x2e8/0x770 [<ffffffff8119ca2a>] workerthread+0x4a/0x4b0 [<ffffffff811a88e0>] kthread+0x120/0x160 [<ffffffff8100242f>] retfromfork+0x1f/0x30
In function wgsocketsendbufferasreplytoskb() or wgsocketsend buffertopeer(), the semantics of send6() is required to free skb. But when CONFIGIPV6 is disable, kfreeskb() is missing. This patch adds it to fix this bug.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49153?
CVE-2022-49153 has a severity rating that indicates a potential memory leak issue in the Linux kernel.
How do I fix CVE-2022-49153?
To fix CVE-2022-49153, users should update their Linux kernel to a version that addresses this vulnerability.
Which Linux kernel versions are affected by CVE-2022-49153?
CVE-2022-49153 affects Linux kernel versions from 5.6 to 5.17.2.
What is the impact of CVE-2022-49153 on Linux systems?
The impact of CVE-2022-49153 includes potential memory leaks when using the WireGuard component with IPv6 disabled.
Is WireGuard impacted by CVE-2022-49153?
Yes, WireGuard is impacted by CVE-2022-49153 due to the handling of sockets in the Linux kernel.