CVE-2022-49013
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
21/10/2024
Last modified:
24/10/2024
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
sctp: fix memory leak in sctp_stream_outq_migrate()<br />
<br />
When sctp_stream_outq_migrate() is called to release stream out resources,<br />
the memory pointed to by prio_head in stream out is not released.<br />
<br />
The memory leak information is as follows:<br />
unreferenced object 0xffff88801fe79f80 (size 64):<br />
comm "sctp_repo", pid 7957, jiffies 4294951704 (age 36.480s)<br />
hex dump (first 32 bytes):<br />
80 9f e7 1f 80 88 ff ff 80 9f e7 1f 80 88 ff ff ................<br />
90 9f e7 1f 80 88 ff ff 90 9f e7 1f 80 88 ff ff ................<br />
backtrace:<br />
[] kmalloc_trace+0x26/0x60<br />
[] sctp_sched_prio_set+0x4cc/0x770<br />
[] sctp_stream_init_ext+0xd2/0x1b0<br />
[] sctp_sendmsg_to_asoc+0x1614/0x1a30<br />
[] sctp_sendmsg+0xda1/0x1ef0<br />
[] inet_sendmsg+0x9d/0xe0<br />
[] sock_sendmsg+0xd3/0x120<br />
[] __sys_sendto+0x23a/0x340<br />
[] __x64_sys_sendto+0xe1/0x1b0<br />
[] do_syscall_64+0x39/0xb0<br />
[] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 4.15 (including) | 5.4.226 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.5 (including) | 5.10.158 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.11 (including) | 5.15.82 (excluding) |
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.16 (including) | 6.0.12 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- https://git.kernel.org/stable/c/0dfb9a566327182387c90100ea54d8426cee8c67
- https://git.kernel.org/stable/c/176ee6c673ccd118e9392fd2dbb165423bdb99ca
- https://git.kernel.org/stable/c/9ed7bfc79542119ac0a9e1ce8a2a5285e43433e9
- https://git.kernel.org/stable/c/a7555681e50bdebed2c40ff7404ee73c2e932993
- https://git.kernel.org/stable/c/fa20f88271259d42ebe66f0a8c4c20199e888c99



