CVE-2022-49534

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49534

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT There is a potential memory leak in lpfc_ignore_els_cmpl() and lpfc_els_rsp_reject() that was allocated from NPIV PLOGI_RJT (lpfc_rcv_plogi()'s login_mbox). Check if cmdiocb->context_un.mbox was allocated in lpfc_ignore_els_cmpl(), and then free it back to phba->mbox_mem_pool along with mbox->ctx_buf for service parameters. For lpfc_els_rsp_reject() failure, free both the ctx_buf for service parameters and the login_mbox.

References
Link Resource
https://git.kernel.org/stable/c/672d1cb40551ea9c95efad43ab6d45e4ab4e015f Patch
https://git.kernel.org/stable/c/c00df0f34a6d5e14da379f96ea67e501ce67b002 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

10 Mar 2025, 21:30

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-401
First Time Linux
Linux linux Kernel
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: lpfc: Fuga de memoria de protección para puertos NPIV que envían PLOGI_RJT Hay una posible fuga de memoria en lpfc_ignore_els_cmpl() y lpfc_els_rsp_reject() que se asignó desde NPIV PLOGI_RJT (login_mbox de lpfc_rcv_plogi()). Compruebe si cmdiocb->context_un.mbox se asignó en lpfc_ignore_els_cmpl() y, a continuación, libérelo de nuevo en phba->mbox_mem_pool junto con mbox->ctx_buf para los parámetros de servicio. En caso de fallo de lpfc_els_rsp_reject(), libere tanto el ctx_buf para los parámetros de servicio como el login_mbox.
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/672d1cb40551ea9c95efad43ab6d45e4ab4e015f - () https://git.kernel.org/stable/c/672d1cb40551ea9c95efad43ab6d45e4ab4e015f - Patch
References () https://git.kernel.org/stable/c/c00df0f34a6d5e14da379f96ea67e501ce67b002 - () https://git.kernel.org/stable/c/c00df0f34a6d5e14da379f96ea67e501ce67b002 - Patch

26 Feb 2025, 07:01

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:01

Updated : 2025-10-01 20:16

NVD link : CVE-2022-49534

Mitre link : CVE-2022-49534

CVE.ORG link : CVE-2022-49534

JSON object : View

Products Affected

linux

CWE
CWE-401

Missing Release of Memory after Effective Lifetime