| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025022639-CVE-2022-49331-f86f@gregkh> Date: Wed, 26 Feb 2025 03:10:05 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2022-49331: nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling Description =========== In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling Error paths do not free previously allocated memory. Add devm_kfree() to those failure paths. The Linux kernel CVE team has assigned CVE-2022-49331 to this issue. Affected and fixed versions =========================== Issue introduced in 4.0 with commit 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 and fixed in 4.9.318 with commit 593773088d615a46a42c97e01a0550d192bb7f74 Issue introduced in 4.0 with commit 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 and fixed in 4.14.283 with commit d221ce54ce331c1a23be71eebf57f6a088632383 Issue introduced in 4.0 with commit 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 and fixed in 4.19.247 with commit 6fce324b530dd74750ad870699e33eeed1029ded Issue introduced in 4.0 with commit 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 and fixed in 5.4.198 with commit 3eca2c42daa4659965db6817479027cbc6df7899 Issue introduced in 4.0 with commit 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 and fixed in 5.10.122 with commit 54423649bc0ed464b75807a7cf2857a5871f738f Issue introduced in 4.0 with commit 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 and fixed in 5.15.47 with commit f444ecd3f57f4ba5090fe8b6756933e37de4226e Issue introduced in 4.0 with commit 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 and fixed in 5.17.15 with commit db836b97464d44340b568e041fd24602858713f7 Issue introduced in 4.0 with commit 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 and fixed in 5.18.4 with commit 55904086041ba4ee4070187b36590f8f8d6df4cd Issue introduced in 4.0 with commit 26fc6c7f02cb26c39c4733de3dbc3c0646fc1074 and fixed in 5.19 with commit 996419e0594abb311fb958553809f24f38e7abbe Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49331 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/nfc/st21nfca/se.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/593773088d615a46a42c97e01a0550d192bb7f74 https://git.kernel.org/stable/c/d221ce54ce331c1a23be71eebf57f6a088632383 https://git.kernel.org/stable/c/6fce324b530dd74750ad870699e33eeed1029ded https://git.kernel.org/stable/c/3eca2c42daa4659965db6817479027cbc6df7899 https://git.kernel.org/stable/c/54423649bc0ed464b75807a7cf2857a5871f738f https://git.kernel.org/stable/c/f444ecd3f57f4ba5090fe8b6756933e37de4226e https://git.kernel.org/stable/c/db836b97464d44340b568e041fd24602858713f7 https://git.kernel.org/stable/c/55904086041ba4ee4070187b36590f8f8d6df4cd https://git.kernel.org/stable/c/996419e0594abb311fb958553809f24f38e7abbe
Powered by blists - more mailing lists