Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2022-49367
CVE-2022-49367:
Linux Kernel vulnerability analysis and mitigation
Overview
CVE-2022-49367 affects the Linux kernel, specifically involving a refcount leak in the mv88e6xxxmdiosregister function. The vulnerability occurs because ofgetchildbyname() returns a node pointer with refcount incremented, but the code was missing the necessary ofnodeput() call when done with the device node (Kernel Git).
Technical details
The technical issue lies in the mv88e6xxxmdioregister() function which passes the device node to ofmdiobusregister(). After this operation, the device node is no longer needed, but the code failed to call ofnodeput() to properly decrement the reference count. This oversight results in a reference count leak in the kernel's memory management system (Kernel Git).
Impact
The vulnerability results in a reference count leak in the Linux kernel's memory management system, which could potentially lead to resource exhaustion over time. This affects systems using the mv88e6xxx DSA (Distributed Switch Architecture) driver (NVD).
Mitigation and workarounds
The issue has been fixed by adding the missing ofnodeput() call after mv88e6xxxmdioregister(). The fix has been incorporated into various Linux kernel versions. Users should update their kernel to a patched version (Kernel Git).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management