CVE-2022-49784

Source
https://nvd.nist.gov/vuln/detail/CVE-2022-49784
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49784.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-49784
Related
Published
2025-05-01T15:16:01Z
Modified
2025-05-02T13:53:20Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

perf/x86/amd/uncore: Fix memory leak for events array

When a CPU comes online, the per-CPU NB and LLC uncore contexts are freed but not the events array within the context structure. This causes a memory leak as identified by the kmemleak detector.

[...] unreferenced object 0xffff8c5944b8e320 (size 32): comm "swapper/0", pid 1, jiffies 4294670387 (age 151.072s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000000759fb79>] amduncorecpuupprepare+0xaf/0x230 [<00000000ddc9e126>] cpuhpinvokecallback+0x2cf/0x470 [<0000000093e727d4>] cpuhpissuecall+0x14d/0x170 [<0000000045464d54>] _cpuhpsetupstatecpuslocked+0x11e/0x330 [<0000000069f67cbd>] _cpuhpsetupstate+0x6b/0x110 [<0000000015365e0f>] amduncoreinit+0x260/0x321 [<00000000089152d2>] dooneinitcall+0x3f/0x1f0 [<000000002d0bd18d>] kernelinitfreeable+0x1ca/0x212 [<0000000030be8dde>] kernelinit+0x11/0x120 [<0000000059709e59>] retfromfork+0x22/0x30 unreferenced object 0xffff8c5944b8dd40 (size 64): comm "swapper/0", pid 1, jiffies 4294670387 (age 151.072s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000306efe8b>] amduncorecpuupprepare+0x183/0x230 [<00000000ddc9e126>] cpuhpinvokecallback+0x2cf/0x470 [<0000000093e727d4>] cpuhpissuecall+0x14d/0x170 [<0000000045464d54>] _cpuhpsetupstatecpuslocked+0x11e/0x330 [<0000000069f67cbd>] _cpuhpsetupstate+0x6b/0x110 [<0000000015365e0f>] amduncoreinit+0x260/0x321 [<00000000089152d2>] dooneinitcall+0x3f/0x1f0 [<000000002d0bd18d>] kernelinitfreeable+0x1ca/0x212 [<0000000030be8dde>] kernelinit+0x11/0x120 [<0000000059709e59>] retfromfork+0x22/0x30 [...]

Fix the problem by freeing the events array before freeing the uncore context.

References

Affected packages

Debian:12 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.10-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / linux

Package

Name
linux
Purl
pkg:deb/debian/linux?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
6.0.10-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}