CVE-2022-49080

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2022-49080
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49080.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-49080
Related
Published
2025-02-26T07:00:45Z
Modified
2025-02-26T19:02:49.483862Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

mm/mempolicy: fix mpolnew leak in sharedpolicy_replace

If mpolnew is allocated but not used in restart loop, mpolnew will be freed via mpolput before returning to the caller. But refcnt is not initialized yet, so mpolput could not do the right things and might leak the unused mpol_new. This would happen if mempolicy was updated on the shared shmem file while the sp->lock has been dropped during the memory allocation.

This issue could be triggered easily with the below code snippet if there are many processes doing the below work at the same time:

shmid = shmget((keyt)5566, 1024 * PAGESIZE, 0666|IPCCREAT); shm = shmat(shmid, 0, 0); loop many times { mbind(shm, 1024 * PAGESIZE, MPOLLOCAL, mask, maxnode, 0); mbind(shm + 128 * PAGESIZE, 128 * PAGESIZE, MPOLDEFAULT, mask, maxnode, 0); }

References

Affected packages

Debian:11 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.10.113-1

Affected versions

5.*

5.10.46-4
5.10.46-5
5.10.70-1~bpo10+1
5.10.70-1
5.10.84-1
5.10.92-1~bpo10+1
5.10.92-1
5.10.92-2
5.10.103-1~bpo10+1
5.10.103-1
5.10.106-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.17.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.17.3-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}