CVE-2022-49219: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49219 is a memory leak vulnerability in the Linux kernel's VFIO PCI driver, specifically during D3hot to D0 power state transitions. The vulnerability was discovered in February 2022 and affects the vfio/pci subsystem. The issue occurs when a PCI device's power state changes from D3hot to D0, where memory allocated for storing device state is not properly freed under certain conditions (Kernel Git).

The vulnerability exists in the vfio_pci_set_power_state function where the PCI device state is saved locally in 'vfio_pci_core_device::pm_save' during D0->D3hot transition. When reset-related IOCTLs are called, the PCI reset APIs internally change the power state back to D0. If the guest resumes and finds the current state as D0, it skips calling vfio_pci_set_power_state() for explicit D0 transition, leaving the memory pointed by 'pm_save' unreleased (Kernel Git).

The vulnerability can be exploited to cause a memory leak by running a malicious sequence of state changes to D3hot followed by VFIO_DEVICE_RESET/VFIO_DEVICE_PCI_HOT_RESET in a loop. This can eventually lead to an Out-of-Memory (OOM) situation on the system (Kernel Git).

The vulnerability requires local access to the system and the ability to manipulate PCI device power states through VFIO interfaces. It can be triggered by a malicious sequence of power state transitions and device resets (Kernel Git).

The issue has been fixed by adding code to free the earlier allocated memory before overwriting 'pm_save' to prevent the memory leak. The fix was implemented through a patch that modifies the vfio_pci_core.c file (Kernel Git).