CVE-2022-49801: tracing: Fix memory leak in tracing_read_pipe()

Q: Who can exploit this issue?

The CVSS vector indicates local access and low privileges are required. The impact is limited to availability, with no reported confidentiality or integrity impact.

Q: What activity triggers the leak?

The leak occurs on the tracing read-pipe path when the trace iterator format is expanded. The reported stack trace includes output from BPF trace_printk events during tracing_read_pipe().

Q: How can administrators identify that the system is affected?

kmemleak can report an unreferenced 128-byte allocation with a stack trace through trace_iter_expand_format, trace_check_vprintf, print_trace_line, and tracing_read_pipe. The allocation is identified as iter->fmt not being freed when the tracing pipe is released.

Published May 1, 2025

Updated

In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix memory leak in tracingreadpipe()

kmemleak reports this issue:

unreferenced object 0xffff888105a18900 (size 128): comm "testprogs", pid 18933, jiffies 4336275356 (age 22801.766s) hex dump (first 32 bytes): 25 73 00 90 81 88 ff ff 26 05 00 00 42 01 58 04 %s......&...B.X. 03 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000560143a1>] kmallocnodetrackcaller+0x4a/0x140 [<000000006af00822>] krealloc+0x8d/0xf0 [<00000000c309be6a>] traceiterexpandformat+0x99/0x150 [<000000005a53bdb6>] tracecheckvprintf+0x1e0/0x11d0 [<0000000065629d9d>] traceeventprintf+0xb6/0xf0 [<000000009a690dc7>] tracerawoutputbpftraceprintk+0x89/0xc0 [<00000000d22db172>] printtraceline+0x73c/0x1480 [<00000000cdba76ba>] tracingreadpipe+0x45c/0x9f0 [<0000000015b58459>] vfsread+0x17b/0x7c0 [<000000004aeee8ed>] ksysread+0xed/0x1c0 [<0000000063d3d898>] dosyscall64+0x3b/0x90 [<00000000a06dda7f>] entrySYSCALL64afterhwframe+0x63/0xcd

iter->fmt alloced in tracingreadpipe() -> .. ->traceiterexpandformat(), but not freed, to fix, add free in tracingreleasepipe()

Affected Software

9 affected components

Linux Linux kernel

Linux Linux kernel>=5.10.190<5.11

Linux Linux kernel>=5.12<5.15.80

Linux Linux kernel>=5.16<6.0.10

Linux Linux kernel=6.1-rc1

Linux Linux kernel=6.1-rc2

Linux Linux kernel=6.1-rc3

Linux Linux kernel=6.1-rc4

Linux Linux kernel=6.1-rc5

Remediation

Event History

May 1, 2025

CVE Published

via MITRE·02:09 PM

Data Sourced

via MITRE·02:09 PM

Description

Data Sourced

via NVD·03:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates local access and low privileges are required. The impact is limited to availability, with no reported confidentiality or integrity impact.

What activity triggers the leak?

The leak occurs on the tracing read-pipe path when the trace iterator format is expanded. The reported stack trace includes output from BPF trace_printk events during tracing_read_pipe().

How can administrators identify that the system is affected?

kmemleak can report an unreferenced 128-byte allocation with a stack trace through trace_iter_expand_format, trace_check_vprintf, print_trace_line, and tracing_read_pipe. The allocation is identified as iter->fmt not being freed when the tracing pipe is released.

What remediation is available?

A patch is available. The fix frees the iter->fmt allocation in tracing_release_pipe().

CVE-2022-49801: tracing: Fix memory leak in tracing_read_pipe()

Affected Software

Remediation

Patch Available

Patch Available

Patch Available

Event History

Frequently Asked Questions

Who can exploit this issue?

What activity triggers the leak?

How can administrators identify that the system is affected?

What remediation is available?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What activity triggers the leak?

How can administrators identify that the system is affected?

What remediation is available?