CVE-2022-49890: capabilities: fix potential memleak on error path from vfs_getxattr_alloc()
In the Linux kernel, the following vulnerability has been resolved:
capabilities: fix potential memleak on error path from vfsgetxattralloc()
In capinodegetsecurity(), we will use vfsgetxattralloc() to complete the memory allocation of tmpbuf, if we have completed the memory allocation of tmpbuf, but failed to call handler->get(...), there will be a memleak in below logic:
|-- ret = (int)vfsgetxattralloc(mntuserns, ...) | / ^^^ alloc for tmpbuf / |-- value = krealloc(xattrvalue, error + 1, flags) | / ^^^ alloc memory / |-- error = handler->get(handler, ...) | / error! / |-- xattrvalue = value | / xattrvalue is &tmpbuf (memory leak!) /
So we will try to free(tmpbuf) after vfsgetxattralloc() fails to fix it.
[PM: subject line and backtrace tweaks]
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49890?
The CVE-2022-49890 vulnerability has a low severity rating due to the specific conditions needed for exploitation.
How do I fix CVE-2022-49890?
To mitigate CVE-2022-49890, update to the latest version of the Linux Kernel where the vulnerability has been patched.
What is the impact of CVE-2022-49890?
CVE-2022-49890 could potentially lead to a memory leak in the Linux kernel during the execution of specific operations.
Is CVE-2022-49890 remotely exploitable?
CVE-2022-49890 is not considered to be remotely exploitable as it requires local access to the affected system.
What versions of the Linux Kernel are affected by CVE-2022-49890?
CVE-2022-49890 affects multiple versions of the Linux Kernel prior to the security patch release.