CVE-2022-48693: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48693 is a vulnerability in the Linux kernel affecting the brcmstb power management (PM) ARM component. The vulnerability was discovered in May 2024 and involves two types of resource leaks in the brcmstb_pm_probe() function: a reference count leak and an __iomem leak. The affected versions include Linux kernel from 4.15 up to versions before 4.19.258, 5.4.213, 5.10.143, 5.15.68, and 5.19.9 (NVD).

The vulnerability exists in the brcmstb_pm_probe() function within the Linux kernel's power management module for ARM systems. There are two specific leak issues: (1) missing of_node_put() calls when for_each_matching_node() breaks, leading to reference count leaks, and (2) missing iounmap() calls for each iomap in the fail path, resulting in __iomem leaks. The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD).

The vulnerability can lead to resource leaks in the Linux kernel's memory management system. These leaks could potentially result in system resource exhaustion over time, affecting system availability. The CVSS scoring indicates that while there is no impact on confidentiality or integrity, there is a high impact on system availability (NVD).

The vulnerability requires local access with low privileges to exploit. No user interaction is needed, but the attacker must have local access to the system. The attack complexity is low, indicating that the exploitation is straightforward once access is obtained (NVD).

The vulnerability has been fixed in the Linux kernel through patches that properly implement resource cleanup. The fix includes adding of_node_put() calls when for_each_matching_node() breaks and implementing iounmap() calls for each iomap in the fail path. The patch has been backported to various kernel versions and is available through distribution-specific updates (Kernel Patch).