CVE-2022-48896

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48896
In the Linux kernel, the following vulnerability has been resolved: ixgbe: fix pci device refcount leak As the comment of pci_get_domain_bus_and_slot() says, it returns a PCI device with refcount incremented, when finish using it, the caller must decrement the reference count by calling pci_dev_put(). In ixgbe_get_first_secondary_devfn() and ixgbe_x550em_a_has_mii(), pci_dev_put() is called to avoid leak.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/112df4cd2b09acd64bcd18f5ef83ba5d07b34bf0 Patch
https://git.kernel.org/stable/c/4c93422a54cd6a349988f42e1c6bf082cf4ea9d8 Patch
https://git.kernel.org/stable/c/53cefa802f070d46c0c518f4865be2c749818a18 Patch
https://git.kernel.org/stable/c/b93fb4405fcb5112c5739c5349afb52ec7f15c07 Patch
https://git.kernel.org/stable/c/c49996c6aa03590e4ef5add8772cb6068d99fd59 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
History

11 Sep 2024, 16:06

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ixgbe: repara la fuga de recuento de dispositivos pci Como dice el comentario de pci_get_domain_bus_and_slot(), devuelve un dispositivo PCI con el recuento de referencia incrementado, cuando termine de usarlo, la persona que llama debe disminuir el recuento de referencias en llamando a pci_dev_put(). En ixgbe_get_first_secondary_devfn() y ixgbe_x550em_a_has_mii(), se llama a pci_dev_put() para evitar fugas.
References () https://git.kernel.org/stable/c/112df4cd2b09acd64bcd18f5ef83ba5d07b34bf0 - () https://git.kernel.org/stable/c/112df4cd2b09acd64bcd18f5ef83ba5d07b34bf0 - Patch
References () https://git.kernel.org/stable/c/4c93422a54cd6a349988f42e1c6bf082cf4ea9d8 - () https://git.kernel.org/stable/c/4c93422a54cd6a349988f42e1c6bf082cf4ea9d8 - Patch
References () https://git.kernel.org/stable/c/53cefa802f070d46c0c518f4865be2c749818a18 - () https://git.kernel.org/stable/c/53cefa802f070d46c0c518f4865be2c749818a18 - Patch
References () https://git.kernel.org/stable/c/b93fb4405fcb5112c5739c5349afb52ec7f15c07 - () https://git.kernel.org/stable/c/b93fb4405fcb5112c5739c5349afb52ec7f15c07 - Patch
References () https://git.kernel.org/stable/c/c49996c6aa03590e4ef5add8772cb6068d99fd59 - () https://git.kernel.org/stable/c/c49996c6aa03590e4ef5add8772cb6068d99fd59 - Patch
CWE CWE-401
CPE cpe:2.3:o:linux:linux_kernel:6.2:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.2:rc2:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5

21 Aug 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-21 07:15

Updated : 2024-09-11 16:06

NVD link : CVE-2022-48896

Mitre link : CVE-2022-48896

CVE.ORG link : CVE-2022-48896

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime