CVE-2022-50521: platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]()
In the Linux kernel, the following vulnerability has been resolved:
platform/x86: mxm-wmi: fix memleak in mxmwmicallmxds|mx
The ACPI buffer memory (out.pointer) returned by wmievaluatemethod() is not freed after the call, so it leads to memory leak.
The method results in ACPI buffer is not used, so just pass NULL to wmievaluatemethod() which fixes the memory leak.
Affected Software
Remediation
Event History
Frequently Asked Questions
What conditions are required to trigger the memory leak?
The issue occurs when the mxm-wmi driver calls wmi_evaluate_method() through mxm_wmi_call_mxds() or mxm_wmi_call_mxmx(). Exploitation requires local access and low privileges, with no user interaction required.
What is the operational impact?
Repeated triggering can leak ACPI buffer memory, potentially exhausting available memory and causing a denial-of-service condition. The provided CVSS vector indicates no confidentiality or integrity impact.
Is a fix available?
Yes. Patches are available in the referenced Linux kernel stable commits.