CVE-2022-50046

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-50046

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change() The issue happens on some error handling paths. When the function fails to grab the object `xprt`, it simply returns 0, forgetting to decrease the reference count of another object `xps`, which is increased by rpc_sysfs_xprt_kobj_get_xprt_switch(), causing refcount leaks. Also, the function forgets to check whether `xps` is valid before using it, which may result in NULL-dereferencing issues. Fix it by adding proper error handling code when either `xprt` or `xps` is NULL.

References
Link Resource
https://git.kernel.org/stable/c/76fbeb1662b1c56514325118a07fba74dc4c79fe Patch
https://git.kernel.org/stable/c/bfc48f1b0505ffcb03a6d749139b7577d6b81ae0 Patch
https://git.kernel.org/stable/c/c0434f0e058648649250b8ed6078b66d773de723 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
History

13 Nov 2025, 18:39

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: net/sunrpc: se corrigen posibles fugas de memoria en rpc_sysfs_xprt_state_change(). El problema se produce en algunas rutas de gestión de errores. Cuando la función no logra capturar el objeto `xprt`, simplemente devuelve 0, olvidando disminuir el recuento de referencias de otro objeto `xps`, que se incrementa mediante rpc_sysfs_xprt_kobj_get_xprt_switch(), lo que provoca fugas de referencias. Además, la función olvida comprobar si `xps` es válido antes de usarlo, lo que puede provocar problemas de desreferenciación a valores NULL. Se puede solucionar añadiendo el código de gestión de errores adecuado cuando `xprt` o `xps` sean valores NULL.
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-401
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/76fbeb1662b1c56514325118a07fba74dc4c79fe - () https://git.kernel.org/stable/c/76fbeb1662b1c56514325118a07fba74dc4c79fe - Patch
References () https://git.kernel.org/stable/c/bfc48f1b0505ffcb03a6d749139b7577d6b81ae0 - () https://git.kernel.org/stable/c/bfc48f1b0505ffcb03a6d749139b7577d6b81ae0 - Patch
References () https://git.kernel.org/stable/c/c0434f0e058648649250b8ed6078b66d773de723 - () https://git.kernel.org/stable/c/c0434f0e058648649250b8ed6078b66d773de723 - Patch

18 Jun 2025, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-18 11:15

Updated : 2025-11-13 18:39

NVD link : CVE-2022-50046

Mitre link : CVE-2022-50046

CVE.ORG link : CVE-2022-50046

JSON object : View

Products Affected

linux

CWE
CWE-401

Missing Release of Memory after Effective Lifetime