« Volver al listado

CVE-2022-50269

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

drm/vkms: Fix memory leak in vkms_init()

A memory leak was reported after the vkms module install failed.

The reason is that the vkms_init() returns without checking the return value of vkms_create(), and if the vkms_create() failed, the config allocated at the beginning of vkms_init() is leaked.

Fix this problem by checking return value of vkms_create() and free the config if error happened.

Detalles técnicos trazas, registros y código del informe original
unreferenced object 0xffff88810bc28520 (size 16):
  comm "modprobe", pid 9662, jiffies 4298009455 (age 42.590s)
  hex dump (first 16 bytes):
    01 01 00 64 81 88 ff ff 00 00 dc 0a 81 88 ff ff  ...d............
  backtrace:
    [<00000000e7561ff8>] kmalloc_trace+0x27/0x60
    [<000000000b1954a0>] 0xffffffffc45200a9
    [<00000000abbf1da0>] do_one_initcall+0xd0/0x4f0
    [<000000001505ee87>] do_init_module+0x1a4/0x680
    [<00000000958079ad>] load_module+0x6249/0x7110
    [<00000000117e4696>] __do_sys_finit_module+0x140/0x200
    [<00000000f74b12d2>] do_syscall_64+0x35/0x80
    [<000000008fc6fcde>] entry_SYSCALL_64_after_hwframe+0x46/0xb0

 vkms_init()
   config = kmalloc(...) # config allocated
   ...
   return vkms_create() # vkms_create failed and config is leaked

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-50269",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2df7af93fdadb9ba8226fe443fae15ecdefda2a6",
              "lessThan": "bad13de764888b765ceaa4668893b52bd16653cc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2df7af93fdadb9ba8226fe443fae15ecdefda2a6",
              "lessThan": "bebd60ec3bf21062f103e32e6203c6daabdbd51b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2df7af93fdadb9ba8226fe443fae15ecdefda2a6",
              "lessThan": "07ab77154d6fd2d67e465ab5ce30083709950f02",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2df7af93fdadb9ba8226fe443fae15ecdefda2a6",
              "lessThan": "0d0b368b9d104b437e1f4850ae94bdb9a3601e89",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/vkms/vkms_drv.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.12"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.12",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.15.99",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.16",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.2.3",
              "versionType": "semver",
              "lessThanOrEqual": "6.2.*"
            },
            {
              "status": "unaffected",
              "version": "6.3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/vkms/vkms_drv.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-09-15T15:15:37.707",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/07ab77154d6fd2d67e465ab5ce30083709950f02",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/0d0b368b9d104b437e1f4850ae94bdb9a3601e89",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bad13de764888b765ceaa4668893b52bd16653cc",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bebd60ec3bf21062f103e32e6203c6daabdbd51b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/vkms: Fix memory leak in vkms_init()\n\nA memory leak was reported after the vkms module install failed.\n\nunreferenced object 0xffff88810bc28520 (size 16):\n  comm \"modprobe\", pid 9662, jiffies 4298009455 (age 42.590s)\n  hex dump (first 16 bytes):\n    01 01 00 64 81 88 ff ff 00 00 dc 0a 81 88 ff ff  ...d............\n  backtrace:\n    [<00000000e7561ff8>] kmalloc_trace+0x27/0x60\n    [<000000000b1954a0>] 0xffffffffc45200a9\n    [<00000000abbf1da0>] do_one_initcall+0xd0/0x4f0\n    [<000000001505ee87>] do_init_module+0x1a4/0x680\n    [<00000000958079ad>] load_module+0x6249/0x7110\n    [<00000000117e4696>] __do_sys_finit_module+0x140/0x200\n    [<00000000f74b12d2>] do_syscall_64+0x35/0x80\n    [<000000008fc6fcde>] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n\nThe reason is that the vkms_init() returns without checking the return\nvalue of vkms_create(), and if the vkms_create() failed, the config\nallocated at the beginning of vkms_init() is leaked.\n\n vkms_init()\n   config = kmalloc(...) # config allocated\n   ...\n   return vkms_create() # vkms_create failed and config is leaked\n\nFix this problem by checking return value of vkms_create() and free the\nconfig if error happened."
    }
  ],
  "lastModified": "2026-06-17T05:23:07.180",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "32D3459E-D24E-4F38-B3C5-1F1532E828DD",
              "versionEndExcluding": "5.15.99",
              "versionStartIncluding": "5.12"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0FD95FDA-6525-4B13-B3FB-49D9995FD8ED",
              "versionEndExcluding": "6.1.16",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "88C67289-22AD-4CA9-B202-5F5A80E5BA4B",
              "versionEndExcluding": "6.2.3",
              "versionStartIncluding": "6.2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}