CVE-2022-48973

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48973
In the Linux kernel, the following vulnerability has been resolved: gpio: amd8111: Fix PCI device reference count leak for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. Add the missing pci_dev_put() after the 'out' label. Since pci_dev_put() can handle NULL input parameter, there is no problem for the 'Device not found' branch. For the normal path, add pci_dev_put() in amd_gpio_exit().

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/4271515f189bd5fe2ec86b4089dab7cb804625d2 Patch
https://git.kernel.org/stable/c/45fecdb9f658d9c82960c98240bc0770ade19aca Patch
https://git.kernel.org/stable/c/4749c5cc147c9860b96db1e71cc36d1de1bd3f59 Patch
https://git.kernel.org/stable/c/48bd5d3801f6b67cc144449d434abbd5043a6d37 Patch
https://git.kernel.org/stable/c/5ee6413d3dd972930af787b2c0c7aaeb379fa521 Patch
https://git.kernel.org/stable/c/71d591ef873f9ebb86cd8d053b3caee785b2de6a Patch
https://git.kernel.org/stable/c/b2bc053ebbba57a06fa655db5ea796de2edce445 Patch
https://git.kernel.org/stable/c/e364ce04d8f840478b09eee57b614de7cf1e743e Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*
History

25 Oct 2024, 15:35

Type Values Removed Values Added
CWE NVD-CWE-Other
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc8:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/4271515f189bd5fe2ec86b4089dab7cb804625d2 - () https://git.kernel.org/stable/c/4271515f189bd5fe2ec86b4089dab7cb804625d2 - Patch
References () https://git.kernel.org/stable/c/45fecdb9f658d9c82960c98240bc0770ade19aca - () https://git.kernel.org/stable/c/45fecdb9f658d9c82960c98240bc0770ade19aca - Patch
References () https://git.kernel.org/stable/c/4749c5cc147c9860b96db1e71cc36d1de1bd3f59 - () https://git.kernel.org/stable/c/4749c5cc147c9860b96db1e71cc36d1de1bd3f59 - Patch
References () https://git.kernel.org/stable/c/48bd5d3801f6b67cc144449d434abbd5043a6d37 - () https://git.kernel.org/stable/c/48bd5d3801f6b67cc144449d434abbd5043a6d37 - Patch
References () https://git.kernel.org/stable/c/5ee6413d3dd972930af787b2c0c7aaeb379fa521 - () https://git.kernel.org/stable/c/5ee6413d3dd972930af787b2c0c7aaeb379fa521 - Patch
References () https://git.kernel.org/stable/c/71d591ef873f9ebb86cd8d053b3caee785b2de6a - () https://git.kernel.org/stable/c/71d591ef873f9ebb86cd8d053b3caee785b2de6a - Patch
References () https://git.kernel.org/stable/c/b2bc053ebbba57a06fa655db5ea796de2edce445 - () https://git.kernel.org/stable/c/b2bc053ebbba57a06fa655db5ea796de2edce445 - Patch
References () https://git.kernel.org/stable/c/e364ce04d8f840478b09eee57b614de7cf1e743e - () https://git.kernel.org/stable/c/e364ce04d8f840478b09eee57b614de7cf1e743e - Patch

23 Oct 2024, 15:13

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: gpio: amd8111: Se solucionó la fuga de recuento de referencia del dispositivo PCI. for_each_pci_dev() se implementa mediante pci_get_device(). El comentario de pci_get_device() dice que aumentará el recuento de referencia para el pci_dev devuelto y también disminuirá el recuento de referencia para el pci_dev de entrada @from si no es NULL. Si interrumpimos el bucle for_each_pci_dev() con pdev no NULL, debemos llamar a pci_dev_put() para disminuir el recuento de referencia. Agregue el pci_dev_put() faltante después de la etiqueta 'out'. Dado que pci_dev_put() puede manejar el parámetro de entrada NULL, no hay ningún problema para la rama 'Dispositivo no encontrado'. Para la ruta normal, agregue pci_dev_put() en amd_gpio_exit().

21 Oct 2024, 20:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-21 20:15

Updated : 2024-10-25 15:35

NVD link : CVE-2022-48973

Mitre link : CVE-2022-48973

CVE.ORG link : CVE-2022-48973

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-Other