CVE-2022-49415: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-49415 is a vulnerability in the Linux kernel's IPMI (Intelligent Platform Management Interface) IPMB (IPMI Bridge) component. The issue was discovered in the ipmi_ipmb_probe function where a reference count leak occurs. The vulnerability stems from of_parse_phandle() returning a node pointer with an incremented reference count without a corresponding of_node_put() call to release it when done (Kernel Git).

The vulnerability is a reference count leak in the ipmi_ipmb_probe function of the Linux kernel's IPMI subsystem. The issue occurs because the of_parse_phandle() function returns a node pointer with an incremented reference count, but the code was missing the required of_node_put() call to properly release the reference when finished. This bug was introduced in commit 00d93611f002 which added the ability to have separate slave and master devices (Kernel Git).

A reference count leak in kernel memory management can potentially lead to memory resource exhaustion over time. While the immediate impact may be minimal, repeated triggering of this condition could eventually lead to system resource depletion (Ubuntu Security).

The vulnerability requires local access to a system with the IPMI IPMB driver loaded. The issue is triggered through normal driver operation when probing IPMI IPMB devices, making it a reliability concern rather than a security exploit vector (NVD).

The vulnerability has been fixed by adding the missing of_node_put() call in the ipmi_ipmb_probe function. The fix was committed to the Linux kernel and is available in updated kernel versions. Users should update their Linux kernel to a patched version that includes this fix (Kernel Git).