CVE-2022-50477: rtc: class: Fix potential memleak in devm_rtc_allocate_device()
In the Linux kernel, the following vulnerability has been resolved:
rtc: class: Fix potential memleak in devmrtcallocatedevice()
devmrtcallocatedevice() will alloc a rtcdevice first, and then run devsetname(). If devsetname() failed, the rtcdevice will memleak. Move devmaddactionorreset() in front of devsetname() to prevent memleak.
unreferenced object 0xffff888110a53000 (size 2048): comm "python3", pid 470, jiffies 4296078308 (age 58.882s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 08 30 a5 10 81 88 ff ff .........0...... 08 30 a5 10 81 88 ff ff 00 00 00 00 00 00 00 00 .0.............. backtrace: [<000000004aac0364>] kmalloctrace+0x21/0x110 [<000000000ff02202>] devmrtcallocatedevice+0xd4/0x400 [<000000001bdf5639>] devmrtcdeviceregister+0x1a/0x80 [<00000000351bf81c>] rx4581probe+0xdd/0x110 [rtcrx4581] [<00000000f0eba0ae>] spiprobe+0xde/0x130 [<00000000bff89ee8>] reallyprobe+0x175/0x3f0 [<00000000128e8d84>] driverprobedevice+0xe6/0x170 [<00000000ee5bf913>] devicedriverattach+0x32/0x80 [<00000000f3f28f92>] bindstore+0x10b/0x1a0 [<000000009ff812d8>] drvattrstore+0x49/0x70 [<000000008139c323>] sysfskfwrite+0x8d/0xb0 [<00000000b6146e01>] kernfsfopwriteiter+0x214/0x2d0 [<00000000ecbe3895>] vfswrite+0x61a/0x7d0 [<00000000aa2196ea>] ksyswrite+0xc8/0x190 [<0000000046a600f5>] dosyscall64+0x37/0x90 [<00000000541a336f>] entrySYSCALL64afterhwframe+0x63/0xcd
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50477?
The severity of CVE-2022-50477 has been classified as moderate due to the potential memory leak in the Linux kernel.
How do I fix CVE-2022-50477?
To fix CVE-2022-50477, update to the latest version of the Linux kernel where the vulnerability has been patched.
What systems are affected by CVE-2022-50477?
CVE-2022-50477 affects various versions of the Linux kernel, particularly those utilizing the rtc device allocation functions.
What are the implications of CVE-2022-50477?
The implications of CVE-2022-50477 include potential system instability and resource exhaustion due to memory leaks.
Is CVE-2022-50477 exploitable?
CVE-2022-50477 is considered low risk in terms of exploitability, primarily affecting scenarios where the rtc device is allocated improperly.