CVE-2022-49389

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49389
In the Linux kernel, the following vulnerability has been resolved: usb: usbip: fix a refcount leak in stub_probe() usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails after that, usb_put_dev() needs to be called to release the reference. Fix this by moving usb_put_dev() to sdev_free error path handling. Find this by code review.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/11c65408bd0ba1d9cd1307caa38169292de9cdfb Patch
https://git.kernel.org/stable/c/247d3809e45a34d9e1a3a2bb7012e31ed8b46031 Patch
https://git.kernel.org/stable/c/2f0ae93ec33c8456cdfbf7876b80403a6318ebce Patch
https://git.kernel.org/stable/c/51422046be504515eb5a591adf0f424b62f46804 Patch
https://git.kernel.org/stable/c/6bafee2f18af5e5ac125e42960bc65496d0e56a0 Patch
https://git.kernel.org/stable/c/8afb048800919d0ab10c57983940eba956339f21 Patch
https://git.kernel.org/stable/c/9ec4cbf1cc55d126759051acfe328d489c5d6e60 Patch
https://git.kernel.org/stable/c/bcbb795a9e78180d74c6ab21518da87e803dfdce Patch
https://git.kernel.org/stable/c/f20d2d3b3364ce6525c050a8b6b4c54c8c19674d Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

17 Apr 2025, 20:47

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/11c65408bd0ba1d9cd1307caa38169292de9cdfb - () https://git.kernel.org/stable/c/11c65408bd0ba1d9cd1307caa38169292de9cdfb - Patch
References () https://git.kernel.org/stable/c/247d3809e45a34d9e1a3a2bb7012e31ed8b46031 - () https://git.kernel.org/stable/c/247d3809e45a34d9e1a3a2bb7012e31ed8b46031 - Patch
References () https://git.kernel.org/stable/c/2f0ae93ec33c8456cdfbf7876b80403a6318ebce - () https://git.kernel.org/stable/c/2f0ae93ec33c8456cdfbf7876b80403a6318ebce - Patch
References () https://git.kernel.org/stable/c/51422046be504515eb5a591adf0f424b62f46804 - () https://git.kernel.org/stable/c/51422046be504515eb5a591adf0f424b62f46804 - Patch
References () https://git.kernel.org/stable/c/6bafee2f18af5e5ac125e42960bc65496d0e56a0 - () https://git.kernel.org/stable/c/6bafee2f18af5e5ac125e42960bc65496d0e56a0 - Patch
References () https://git.kernel.org/stable/c/8afb048800919d0ab10c57983940eba956339f21 - () https://git.kernel.org/stable/c/8afb048800919d0ab10c57983940eba956339f21 - Patch
References () https://git.kernel.org/stable/c/9ec4cbf1cc55d126759051acfe328d489c5d6e60 - () https://git.kernel.org/stable/c/9ec4cbf1cc55d126759051acfe328d489c5d6e60 - Patch
References () https://git.kernel.org/stable/c/bcbb795a9e78180d74c6ab21518da87e803dfdce - () https://git.kernel.org/stable/c/bcbb795a9e78180d74c6ab21518da87e803dfdce - Patch
References () https://git.kernel.org/stable/c/f20d2d3b3364ce6525c050a8b6b4c54c8c19674d - () https://git.kernel.org/stable/c/f20d2d3b3364ce6525c050a8b6b4c54c8c19674d - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux linux Kernel
Linux
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: usb: usbip: se corrige una pérdida de recuento de referencias en stub_probe(). Se llama a usb_get_dev() en stub_device_alloc(). Cuando stub_probe() falla después de eso, se debe llamar a usb_put_dev() para liberar la referencia. Corrija esto moviendo usb_put_dev() a la gestión de la ruta de error sdev_free. Encuentre esto mediante la revisión del código.
CWE NVD-CWE-Other

26 Feb 2025, 07:01

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:01

Updated : 2025-04-17 20:47

NVD link : CVE-2022-49389

Mitre link : CVE-2022-49389

CVE.ORG link : CVE-2022-49389

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-Other