CVE-2022-49648

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Fix memory leak problem This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac. As commit 46bbe5c671e0 ("tracing: fix double free") said, the "double free" problem reported by clang static analyzer is: > In parse_var_defs() if there is a problem allocating > var_defs.expr, the earlier var_defs.name is freed. > This free is duplicated by free_var_defs() which frees > the rest of the list. However, if there is a problem allocating N-th var_defs.expr: + in parse_var_defs(), the freed 'earlier var_defs.name' is actually the N-th var_defs.name; + then in free_var_defs(), the names from 0th to (N-1)-th are freed; IF ALLOCATING PROBLEM HAPPENED HERE!!! -+ \ | 0th 1th (N-1)-th N-th V +-------------+-------------+-----+-------------+----------- var_defs: | name | expr | name | expr | ... | name | expr | name | /// +-------------+-------------+-----+-------------+----------- These two frees don't act on same name, so there was no "double free" problem before. Conversely, after that commit, we get a "memory leak" problem because the above "N-th var_defs.name" is not freed. If enable CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th var_defs.expr allocated, then execute on shell like: $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \ /sys/kernel/debug/tracing/events/kmem/kmalloc/trigger Then kmemleak reports: unreferenced object 0xffff8fb100ef3518 (size 8): comm "bash", pid 196, jiffies 4295681690 (age 28.538s) hex dump (first 8 bytes): 76 31 00 00 b1 8f ff ff v1...... backtrace: [<0000000038fe4895>] kstrdup+0x2d/0x60 [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0 [<00000000ae70d2cc>] trigger_process_regex+0xc0/0x110 [<0000000066737a4c>] event_trigger_write+0x75/0xd0 [<000000007341e40c>] vfs_write+0xbb/0x2a0 [<0000000087fde4c2>] ksys_write+0x59/0xd0 [<00000000581e9cdf>] do_syscall_64+0x3a/0x80 [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/22eeff55679d9e7c0f768c79bfbd83e2f8142d89	Patch
https://git.kernel.org/stable/c/4d453eb5e1eec89971aa5b3262857ee26cfdffd3	Patch
https://git.kernel.org/stable/c/78a1400c42ee11197eb1f0f85ba51df9a4fdfff0	Patch
https://git.kernel.org/stable/c/7edc3945bdce9c39198a10d6129377a5c53559c2	Patch
https://git.kernel.org/stable/c/eb622d5580b9e2ff694f62da6410618bd73853cb	Patch
https://git.kernel.org/stable/c/ecc6dec12c33aa92c086cd702af9f544ddaf3c75	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:5.19:rc1::::::
	cpe:2.3:o:linux:linux_kernel:5.19:rc2::::::
	cpe:2.3:o:linux:linux_kernel:5.19:rc3::::::
	cpe:2.3:o:linux:linux_kernel:5.19:rc4::::::
	cpe:2.3:o:linux:linux_kernel:5.19:rc5::::::
	cpe:2.3:o:linux:linux_kernel:5.19:rc6::::::

History

11 Mar 2025, 22:35

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 5.5
First Time		Linux Linux linux Kernel
CWE		CWE-401
References	~~() https://git.kernel.org/stable/c/22eeff55679d9e7c0f768c79bfbd83e2f8142d89 -~~	() https://git.kernel.org/stable/c/22eeff55679d9e7c0f768c79bfbd83e2f8142d89 - Patch
References	~~() https://git.kernel.org/stable/c/4d453eb5e1eec89971aa5b3262857ee26cfdffd3 -~~	() https://git.kernel.org/stable/c/4d453eb5e1eec89971aa5b3262857ee26cfdffd3 - Patch
References	~~() https://git.kernel.org/stable/c/78a1400c42ee11197eb1f0f85ba51df9a4fdfff0 -~~	() https://git.kernel.org/stable/c/78a1400c42ee11197eb1f0f85ba51df9a4fdfff0 - Patch
References	~~() https://git.kernel.org/stable/c/7edc3945bdce9c39198a10d6129377a5c53559c2 -~~	() https://git.kernel.org/stable/c/7edc3945bdce9c39198a10d6129377a5c53559c2 - Patch
References	~~() https://git.kernel.org/stable/c/eb622d5580b9e2ff694f62da6410618bd73853cb -~~	() https://git.kernel.org/stable/c/eb622d5580b9e2ff694f62da6410618bd73853cb - Patch
References	~~() https://git.kernel.org/stable/c/ecc6dec12c33aa92c086cd702af9f544ddaf3c75 -~~	() https://git.kernel.org/stable/c/ecc6dec12c33aa92c086cd702af9f544ddaf3c75 - Patch
CPE		cpe:2.3:o:linux:linux_kernel:::::::: cpe:2.3:o:linux:linux_kernel:5.19:rc5:::::: cpe:2.3:o:linux:linux_kernel:5.19:rc2:::::: cpe:2.3:o:linux:linux_kernel:5.19:rc4:::::: cpe:2.3:o:linux:linux_kernel:5.19:rc3:::::: cpe:2.3:o:linux:linux_kernel:5.19:rc1:::::: cpe:2.3:o:linux:linux_kernel:5.19:rc6::::::
Summary		(es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing/histograms: Fix memory leak problem Esto revierte el commit 46bbe5c671e06f070428b9be142cc4ee5cedebac. Como decía el commit 46bbe5c671e0 ("tracing: fix double free"), el problema de "doble liberación" informado por el analizador estático de clang es: > En parse_var_defs(), si hay un problema al asignar var_defs.expr, se libera el var_defs.name anterior. > Esta liberación se duplica mediante free_var_defs(), que libera el resto de la lista. Sin embargo, si hay un problema al asignar la N-ésima var_defs.expr: + en parse_var_defs(), el 'var_defs.name anterior' liberado es en realidad el N-ésimo var_defs.name; + entonces en free_var_defs(), los nombres del 0 al (N-1)-ésimo se liberan; ¡SI SUCEDIÓ UN PROBLEMA DE ASIGNACIÓN AQUÍ!!! -+ \ \| 0th 1th (N-1)-th N-th V +-------------+-------------+-----+-------------+----------- var_defs: \| name \| expr \| name \| expr \| ... \| name \| expr \| name \| /// +-------------+-------------+-----+-------------+----------- Estas dos liberaciones no actúan sobre el mismo nombre, por lo que antes no había un problema de "doble liberación". Por el contrario, después de esa confirmación, tenemos un problema de "pérdida de memoria" porque el "N-ésimo var_defs.name" anterior no se libera. Si habilita CONFIG_DEBUG_KMEMLEAK e inyecta un error en el lugar donde se asignó el N-ésimo var_defs.expr, entonces ejecute en el shell de esta manera: $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \ /sys/kernel/debug/tracing/events/kmem/kmalloc/trigger Then kmemleak reports: unreferenced object 0xffff8fb100ef3518 (size 8): comm "bash", pid 196, jiffies 4295681690 (age 28.538s) hex dump (first 8 bytes): 76 31 00 00 b1 8f ff ff v1...... backtrace: [<0000000038fe4895>] kstrdup+0x2d/0x60 [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0 [<00000000ae70d2cc>] trigger_process_regex+0xc0/0x110 [<0000000066737a4c>] event_trigger_write+0x75/0xd0 [<000000007341e40c>] vfs_write+0xbb/0x2a0 [<0000000087fde4c2>] ksys_write+0x59/0xd0 [<00000000581e9cdf>] do_syscall_64+0x3a/0x80 [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

26 Feb 2025, 07:01

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-02-26 07:01

Updated : 2025-03-11 22:35

NVD link : CVE-2022-49648

Mitre link : CVE-2022-49648

CVE.ORG link : CVE-2022-49648

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-401

Missing Release of Memory after Effective Lifetime

{"id": "CVE-2022-49648", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2025-02-26T07:01:39.957", "references": [{"url": "https://git.kernel.org/stable/c/22eeff55679d9e7c0f768c79bfbd83e2f8142d89", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4d453eb5e1eec89971aa5b3262857ee26cfdffd3", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/78a1400c42ee11197eb1f0f85ba51df9a4fdfff0", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7edc3945bdce9c39198a10d6129377a5c53559c2", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/eb622d5580b9e2ff694f62da6410618bd73853cb", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ecc6dec12c33aa92c086cd702af9f544ddaf3c75", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Fix memory leak problem\n\nThis reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac.\n\nAs commit 46bbe5c671e0 (\"tracing: fix double free\") said, the\n\"double free\" problem reported by clang static analyzer is:\n > In parse_var_defs() if there is a problem allocating\n > var_defs.expr, the earlier var_defs.name is freed.\n > This free is duplicated by free_var_defs() which frees\n > the rest of the list.\n\nHowever, if there is a problem allocating N-th var_defs.expr:\n + in parse_var_defs(), the freed 'earlier var_defs.name' is\n actually the N-th var_defs.name;\n + then in free_var_defs(), the names from 0th to (N-1)-th are freed;\n\n IF ALLOCATING PROBLEM HAPPENED HERE!!! -+\n \\\n |\n 0th 1th (N-1)-th N-th V\n +-------------+-------------+-----+-------------+-----------\nvar_defs: | name | expr | name | expr | ... | name | expr | name | ///\n +-------------+-------------+-----+-------------+-----------\n\nThese two frees don't act on same name, so there was no \"double free\"\nproblem before. Conversely, after that commit, we get a \"memory leak\"\nproblem because the above \"N-th var_defs.name\" is not freed.\n\nIf enable CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th\nvar_defs.expr allocated, then execute on shell like:\n $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \\\n/sys/kernel/debug/tracing/events/kmem/kmalloc/trigger\n\nThen kmemleak reports:\n unreferenced object 0xffff8fb100ef3518 (size 8):\n comm \"bash\", pid 196, jiffies 4295681690 (age 28.538s)\n hex dump (first 8 bytes):\n 76 31 00 00 b1 8f ff ff v1......\n backtrace:\n [<0000000038fe4895>] kstrdup+0x2d/0x60\n [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0\n [<00000000ae70d2cc>] trigger_process_regex+0xc0/0x110\n [<0000000066737a4c>] event_trigger_write+0x75/0xd0\n [<000000007341e40c>] vfs_write+0xbb/0x2a0\n [<0000000087fde4c2>] ksys_write+0x59/0xd0\n [<00000000581e9cdf>] do_syscall_64+0x3a/0x80\n [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0"}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tracing/histograms: Fix memory leak problem Esto revierte el commit 46bbe5c671e06f070428b9be142cc4ee5cedebac. Como dec\u00eda el commit 46bbe5c671e0 (\"tracing: fix double free\"), el problema de \"doble liberaci\u00f3n\" informado por el analizador est\u00e1tico de clang es: > En parse_var_defs(), si hay un problema al asignar var_defs.expr, se libera el var_defs.name anterior. > Esta liberaci\u00f3n se duplica mediante free_var_defs(), que libera el resto de la lista. Sin embargo, si hay un problema al asignar la N-\u00e9sima var_defs.expr: + en parse_var_defs(), el 'var_defs.name anterior' liberado es en realidad el N-\u00e9simo var_defs.name; + entonces en free_var_defs(), los nombres del 0 al (N-1)-\u00e9simo se liberan; \u00a1SI SUCEDI\u00d3 UN PROBLEMA DE ASIGNACI\u00d3N AQU\u00cd!!! -+ \\ | 0th 1th (N-1)-th N-th V +-------------+-------------+-----+-------------+----------- var_defs: | name | expr | name | expr | ... | name | expr | name | /// +-------------+-------------+-----+-------------+----------- Estas dos liberaciones no act\u00faan sobre el mismo nombre, por lo que antes no hab\u00eda un problema de \"doble liberaci\u00f3n\". Por el contrario, despu\u00e9s de esa confirmaci\u00f3n, tenemos un problema de \"p\u00e9rdida de memoria\" porque el \"N-\u00e9simo var_defs.name\" anterior no se libera. Si habilita CONFIG_DEBUG_KMEMLEAK e inyecta un error en el lugar donde se asign\u00f3 el N-\u00e9simo var_defs.expr, entonces ejecute en el shell de esta manera: $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \\ /sys/kernel/debug/tracing/events/kmem/kmalloc/trigger Then kmemleak reports: unreferenced object 0xffff8fb100ef3518 (size 8): comm \"bash\", pid 196, jiffies 4295681690 (age 28.538s) hex dump (first 8 bytes): 76 31 00 00 b1 8f ff ff v1...... backtrace: [<0000000038fe4895>] kstrdup+0x2d/0x60 [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0 [<00000000ae70d2cc>] trigger_process_regex+0xc0/0x110 [<0000000066737a4c>] event_trigger_write+0x75/0xd0 [<000000007341e40c>] vfs_write+0xbb/0x2a0 [<0000000087fde4c2>] ksys_write+0x59/0xd0 [<00000000581e9cdf>] do_syscall_64+0x3a/0x80 [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 "}], "lastModified": "2025-03-11T22:35:11.613", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09EE9BBC-7D0D-4330-9AB8-A660909D800A", "versionEndExcluding": "4.19.253", "versionStartIncluding": "4.19.149"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A61D2E61-AF99-4E32-AB1E-CF7ECE0A15AA", "versionEndExcluding": "5.4.207", "versionStartIncluding": "5.4.69"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "03678599-1EF3-4852-9209-86F4922C0CFF", "versionEndExcluding": "5.10.132", "versionStartIncluding": "5.8.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AF59CE2F-BA66-4BFD-83AB-4576F3D1B49A", "versionEndExcluding": "5.15.56", "versionStartIncluding": "5.11"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "640221A7-96EE-4B48-8FE1-BA810131789B", "versionEndExcluding": "5.18.13", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8C30C2D-F82D-4D37-AB48-D76ABFBD5377"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BF8547FC-C849-4F1B-804B-A93AE2F04A92"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F3068028-F453-4A1C-B80F-3F5609ACEF60"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2E9C0DB0-D349-489F-A3D6-B77214E93A8A"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A0DE3B7-0FFB-45AA-9BD6-19870CA7C6FD"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.19:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00AE778B-BAEE-49EB-9F84-003B73D7862A"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}

5.5 /10