CVE-2022-50042
In the Linux kernel, the following vulnerability has been resolved: net: genl: fix error path memory leak in policy dumping If construction of the array of policies fails when recording non-first policy we need to unwind.…
Does this matter?
Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.
Description
In the Linux kernel, the following vulnerability has been resolved: net: genl: fix error path memory leak in policy dumping If construction of the array of policies fails when recording non-first policy we need to unwind. netlink_policy_dump_add_policy() itself also needs fixing as it currently gives up on error without recording the allocated pointer in the pstate pointer.
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.23% probability · 14th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-401
- Affected
- linux/linux kernel
- Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
References
- https://git.kernel.org/stable/c/249801360db3dec4f73768c502192020bfddeaccPatch
- https://git.kernel.org/stable/c/26b6acd365823e99e46be3b27500f5dc235dda5ePatch
- https://git.kernel.org/stable/c/83411c9f05d5a8b637293b3389eca3d378197c04Patch
- https://git.kernel.org/stable/c/b0672895d8be5d19d4b05ac83f807026fc791037Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.