| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2025091500-CVE-2022-50311-0c21@gregkh> Date: Mon, 15 Sep 2025 16:46:13 +0200 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...nel.org> Subject: CVE-2022-50311: cxl: Fix refcount leak in cxl_calc_capp_routing From: Greg Kroah-Hartman <gregkh@...nel.org> Description =========== In the Linux kernel, the following vulnerability has been resolved: cxl: Fix refcount leak in cxl_calc_capp_routing of_get_next_parent() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. This function only calls of_node_put() in normal path, missing it in the error path. Add missing of_node_put() to avoid refcount leak. The Linux kernel CVE team has assigned CVE-2022-50311 to this issue. Affected and fixed versions =========================== Issue introduced in 4.12 with commit f24be42aab37c6d07c05126673138e06223a6399 and fixed in 4.14.303 with commit c9bebc503881c1391f6c4f820134884adecf1519 Issue introduced in 4.12 with commit f24be42aab37c6d07c05126673138e06223a6399 and fixed in 4.19.270 with commit ee870f72465015327ad96204b0e92450d04870cd Issue introduced in 4.12 with commit f24be42aab37c6d07c05126673138e06223a6399 and fixed in 5.4.229 with commit f2d60f6ba173cded65081cee690b67802395a479 Issue introduced in 4.12 with commit f24be42aab37c6d07c05126673138e06223a6399 and fixed in 5.10.163 with commit 81c8bbf5b2b5f0c8030fff1716c00849cda8571a Issue introduced in 4.12 with commit f24be42aab37c6d07c05126673138e06223a6399 and fixed in 5.15.86 with commit 6a310e8db5409676b4b3e6c1f54dff174e4fd04d Issue introduced in 4.12 with commit f24be42aab37c6d07c05126673138e06223a6399 and fixed in 6.0.16 with commit 651e8bc9d0418c20a1989b7c078c64c2a6346fa3 Issue introduced in 4.12 with commit f24be42aab37c6d07c05126673138e06223a6399 and fixed in 6.1.2 with commit 2d7b6580384e6d65419933ddc525bd176095da54 Issue introduced in 4.12 with commit f24be42aab37c6d07c05126673138e06223a6399 and fixed in 6.2 with commit 1d09697ff22908ae487fc8c4fbde1811732be523 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-50311 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/misc/cxl/pci.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/c9bebc503881c1391f6c4f820134884adecf1519 https://git.kernel.org/stable/c/ee870f72465015327ad96204b0e92450d04870cd https://git.kernel.org/stable/c/f2d60f6ba173cded65081cee690b67802395a479 https://git.kernel.org/stable/c/81c8bbf5b2b5f0c8030fff1716c00849cda8571a https://git.kernel.org/stable/c/6a310e8db5409676b4b3e6c1f54dff174e4fd04d https://git.kernel.org/stable/c/651e8bc9d0418c20a1989b7c078c64c2a6346fa3 https://git.kernel.org/stable/c/2d7b6580384e6d65419933ddc525bd176095da54 https://git.kernel.org/stable/c/1d09697ff22908ae487fc8c4fbde1811732be523
Powered by blists - more mailing lists