CVE-2022-50396: In the Linux kernel, the following vulnerability has been resolved: net: sched: fix memory leak in tcindex_set_parms Syzkaller reports a memory leak as…

PriorityP419medium5.5CVSS 3.1

AVLACLPRLUINSUCNINAH

EPSS

0.16%

5.5th percentile

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix memory leak in tcindex_set_parms Syzkaller reports a memory leak as follows: BUG: memory leak unreferenced object 0xffff88810c287f00 (size 256): comm "syz-executor105", pid 3600, jiffies 4294943292 (age 12.990s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmalloc_trace+0x20/0x90 mm/slab_common.c:1046 [] kmalloc include/linux/slab.h:576 [inline] [] kmalloc_array include/linux/slab.h:627 [inline] [] kcalloc include/linux/slab.h:659 [inline] [] tcf_exts_init include/net/pkt_cls.h:250 [inline] [] tcindex_set_parms+0xa7/0xbe0 net/sched/cls_tcindex.c:342 [] tcindex_change+0xdf/0x120 net/sched/cls_tcindex.c:553 [] tc_new_tfilter+0x4f2/0x1100 net/sched/cls_api.c:2147 [] rtnetlink_rcv_msg+0x4dc/0x5d0 net/core/rtnetlink.c:6082 [] netlink_rcv_skb+0x87/0x1d0 net/netlink/af_netlink.c:2540 [] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] [] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345 [] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921 [] sock_sendmsg_nosec net/socket.c:714 [inline] [] sock_sendmsg+0x56/0x80 net/socket.c:734 [] ____sys_sendmsg+0x178/0x410 net/socket.c:2482 [] ___sys_sendmsg+0xa8/0x110 net/socket.c:2536 [] __sys_sendmmsg+0x105/0x330 net/socket.c:2622 [] __do_sys_sendmmsg net/socket.c:2651 [inline] [] __se_sys_sendmmsg net/socket.c:2648 [inline] [] __x64_sys_sendmmsg+0x24/0x30 net/socket.c:2648 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x63/0xcd Kernel uses tcindex_change() to change an existing filter properties. Yet the problem is that, during the process of changing, if `old_r` is retrieved from `p->perfect`, then kernel uses tcindex_alloc_perfect_hash() to newly allocate filter results, uses tcindex_filter_result_i

Affected

27 ranges· showing 25

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.7-1 (bookworm)	linux 6.1.7-1 (bookworm)
linux	linux	—	—
linux	linux	>= b9a24bb76bf611a5268ceffe04219e6ad264559b < 53af9c793f644d5841d84d8e0ad83bd7ab47f3e0	53af9c793f644d5841d84d8e0ad83bd7ab47f3e0
linux	linux	>= b9a24bb76bf611a5268ceffe04219e6ad264559b < 01d0d2b8b4e3cf2110baba9371c0c3d04ad5c77b	01d0d2b8b4e3cf2110baba9371c0c3d04ad5c77b
linux	linux	>= b9a24bb76bf611a5268ceffe04219e6ad264559b < 55ac68b53f1cea1926ee2313afc5d66b91daad71	55ac68b53f1cea1926ee2313afc5d66b91daad71
linux	linux	>= b9a24bb76bf611a5268ceffe04219e6ad264559b < 7a6fb69bbcb21e9ce13bdf18c008c268874f0480	7a6fb69bbcb21e9ce13bdf18c008c268874f0480
linux	linux	>= b9a24bb76bf611a5268ceffe04219e6ad264559b < b314f6c3512108d7a656c5caf07c82d1bbbdc0f1	b314f6c3512108d7a656c5caf07c82d1bbbdc0f1
linux	linux	>= b9a24bb76bf611a5268ceffe04219e6ad264559b < 18c3fa7a7fdbb4d21dafc8a7710ae2c1680930f6	18c3fa7a7fdbb4d21dafc8a7710ae2c1680930f6
linux	linux	>= b9a24bb76bf611a5268ceffe04219e6ad264559b < 6c55953e232ea668731091d111066521f3b7719b	6c55953e232ea668731091d111066521f3b7719b
linux	linux	>= b9a24bb76bf611a5268ceffe04219e6ad264559b < 7c183dc0af472dec33d2c0786a5e356baa8cad19	7c183dc0af472dec33d2c0786a5e356baa8cad19
linux	linux	>= b9a24bb76bf611a5268ceffe04219e6ad264559b < c4de6057e7c6654983acb63d939d26ac0d7bbf39	c4de6057e7c6654983acb63d939d26ac0d7bbf39
linux	linux	>= b9a24bb76bf611a5268ceffe04219e6ad264559b < facc4405e8b7407e03216207b1d1d640127de0c8	facc4405e8b7407e03216207b1d1d640127de0c8
linux	linux	>= b9a24bb76bf611a5268ceffe04219e6ad264559b < 3abebc503a5148072052c229c6b04b329a420ecd	3abebc503a5148072052c229c6b04b329a420ecd
linux	linux	>= b9a24bb76bf611a5268ceffe04219e6ad264559b < 399ab7fe0fa0d846881685fd4e57e9a8ef7559f7	399ab7fe0fa0d846881685fd4e57e9a8ef7559f7
linux	linux	>= b9a24bb76bf611a5268ceffe04219e6ad264559b < 372ae77cf11d11fb118cbe2d37def9dd5f826abd	372ae77cf11d11fb118cbe2d37def9dd5f826abd
linux	linux_kernel	>= 0 < 5.10.178-1	5.10.178-1
linux	linux_kernel	>= 0 < 6.1.7-1	6.1.7-1
linux	linux_kernel	>= 0 < 6.1.7-1	6.1.7-1
linux	linux_kernel	>= 0 < 6.1.7-1	6.1.7-1
linux	linux_kernel	>= 4.15 < 4.19.276	4.19.276
linux	linux_kernel	>= 4.20 < 5.4.235	5.4.235
linux	linux_kernel	>= 4.9 < 4.14.308	4.14.308
linux	linux_kernel	>= 5.11 < 5.15.100	5.15.100
linux	linux_kernel	>= 5.16 < 6.0.19	6.0.19
linux	linux_kernel	>= 5.5 < 5.10.173	5.10.173

CVSS provenance

nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv5.5MEDIUM

vendor_debian5.5MEDIUM

vendor_redhat5.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.