| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025022621-CVE-2022-49657-0cbf@gregkh> Date: Wed, 26 Feb 2025 03:23:40 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2022-49657: usbnet: fix memory leak in error case Description =========== In the Linux kernel, the following vulnerability has been resolved: usbnet: fix memory leak in error case usbnet_write_cmd_async() mixed up which buffers need to be freed in which error case. v2: add Fixes tag v3: fix uninitialized buf pointer The Linux kernel CVE team has assigned CVE-2022-49657 to this issue. Affected and fixed versions =========================== Issue introduced in 3.8 with commit 877bd862f32b815d54ab5fc10a4fd903d7bf3012 and fixed in 4.9.323 with commit 3eed421ca5c809da93456f69203d164d5220be3d Issue introduced in 3.8 with commit 877bd862f32b815d54ab5fc10a4fd903d7bf3012 and fixed in 4.14.288 with commit 5269209f54dd8dfd15f9383f3a3a1fe8370764f8 Issue introduced in 3.8 with commit 877bd862f32b815d54ab5fc10a4fd903d7bf3012 and fixed in 4.19.252 with commit d5165e657987ff4ba0ace896d4376a3718a9fbc3 Issue introduced in 3.8 with commit 877bd862f32b815d54ab5fc10a4fd903d7bf3012 and fixed in 5.4.205 with commit 04894ab34faf40ab72a8a5ab5b404bb0606bbbff Issue introduced in 3.8 with commit 877bd862f32b815d54ab5fc10a4fd903d7bf3012 and fixed in 5.10.130 with commit 0085da9df3dced730027923a6b48f58e9016af91 Issue introduced in 3.8 with commit 877bd862f32b815d54ab5fc10a4fd903d7bf3012 and fixed in 5.15.54 with commit db89582ff330556188da856e01382ccbf3a5e706 Issue introduced in 3.8 with commit 877bd862f32b815d54ab5fc10a4fd903d7bf3012 and fixed in 5.18.11 with commit e7b4f69946a38209b4a4f660bf0e4cbed94f9b4b Issue introduced in 3.8 with commit 877bd862f32b815d54ab5fc10a4fd903d7bf3012 and fixed in 5.19 with commit b55a21b764c1e182014630fa5486d717484ac58f Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49657 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/usb/usbnet.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3eed421ca5c809da93456f69203d164d5220be3d https://git.kernel.org/stable/c/5269209f54dd8dfd15f9383f3a3a1fe8370764f8 https://git.kernel.org/stable/c/d5165e657987ff4ba0ace896d4376a3718a9fbc3 https://git.kernel.org/stable/c/04894ab34faf40ab72a8a5ab5b404bb0606bbbff https://git.kernel.org/stable/c/0085da9df3dced730027923a6b48f58e9016af91 https://git.kernel.org/stable/c/db89582ff330556188da856e01382ccbf3a5e706 https://git.kernel.org/stable/c/e7b4f69946a38209b4a4f660bf0e4cbed94f9b4b https://git.kernel.org/stable/c/b55a21b764c1e182014630fa5486d717484ac58f
Powered by blists - more mailing lists