CVE-2022-49803
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
01/05/2025
Last modified:
07/11/2025
Description
In the Linux kernel, the following vulnerability has been resolved:<br />
<br />
netdevsim: Fix memory leak of nsim_dev->fa_cookie<br />
<br />
kmemleak reports this issue:<br />
<br />
unreferenced object 0xffff8881bac872d0 (size 8):<br />
comm "sh", pid 58603, jiffies 4481524462 (age 68.065s)<br />
hex dump (first 8 bytes):<br />
04 00 00 00 de ad be ef ........<br />
backtrace:<br />
[] __kmalloc+0x49/0x150<br />
[] nsim_dev_trap_fa_cookie_write+0xc1/0x210 [netdevsim]<br />
[] full_proxy_write+0xf3/0x180<br />
[] vfs_write+0x1c5/0xaf0<br />
[] ksys_write+0xed/0x1c0<br />
[] do_syscall_64+0x3b/0x90<br />
[] entry_SYSCALL_64_after_hwframe+0x63/0xcd<br />
<br />
The issue occurs in the following scenarios:<br />
<br />
nsim_dev_trap_fa_cookie_write()<br />
kmalloc() fa_cookie<br />
nsim_dev->fa_cookie = fa_cookie<br />
..<br />
nsim_drv_remove()<br />
<br />
The fa_cookie allocked in nsim_dev_trap_fa_cookie_write() is not freed. To<br />
fix, add kfree(nsim_dev->fa_cookie) to nsim_drv_remove().
Impact
Base Score 3.x
5.50
Severity 3.x
MEDIUM
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | 5.7 (including) | 6.0.10 (excluding) |
| cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:* | ||
| cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page



