cbcvebase.
CVE-2022-49000
published 2024-10-21

CVE-2022-49000: In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix PCI device refcount leak in has_external_pci() for_each_pci_dev() is…

PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.24%
15.8th percentile
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix PCI device refcount leak in has_external_pci() for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. Add the missing pci_dev_put() before 'return true' to avoid reference count leak.

Affected

14 ranges
VendorProductVersion rangeFixed in
debianlinux< linux 6.0.12-1 (bookworm)linux 6.0.12-1 (bookworm)
linuxlinux
linuxlinux>= 89a6079df791aeace2044ea93be1b397195824ec < 10ed7655a17f6a3eaecd1293830488259ccd572310ed7655a17f6a3eaecd1293830488259ccd5723
linuxlinux>= 89a6079df791aeace2044ea93be1b397195824ec < b6eea8b2e858a20ad58ac62dc2de90fea2413f94b6eea8b2e858a20ad58ac62dc2de90fea2413f94
linuxlinux>= 89a6079df791aeace2044ea93be1b397195824ec < 17f67414718e6aba123335a33b7d15aa594fff3417f67414718e6aba123335a33b7d15aa594fff34
linuxlinux>= 89a6079df791aeace2044ea93be1b397195824ec < afca9e19cc720bfafc75dc5ce429c185ca93f31dafca9e19cc720bfafc75dc5ce429c185ca93f31d
linuxlinux_kernel
linuxlinux_kernel>= 0 < 5.10.158-15.10.158-1
linuxlinux_kernel>= 0 < 6.0.12-16.0.12-1
linuxlinux_kernel>= 0 < 6.0.12-16.0.12-1
linuxlinux_kernel>= 0 < 6.0.12-16.0.12-1
linuxlinux_kernel>= 5.0 < 5.10.1585.10.158
linuxlinux_kernel>= 5.11 < 5.15.825.15.82
linuxlinux_kernel>= 5.16 < 6.0.126.0.12

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.