CVE-2022-49467: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49467 is a memory leak vulnerability discovered in the Linux kernel's DRM (Direct Rendering Manager) MSM driver, specifically in the mdp5_crtc_cursor_set() function. The vulnerability was identified and fixed in 2022, affecting the hardware cursor support functionality in the MSM DRM driver (Kernel Commit). The issue has a CVSS v3.1 score of 5.5, indicating moderate severity (Red Hat).

The vulnerability occurs in the mdp5_crtc_cursor_set() function where drm_gem_object_lookup() calls drm_gem_object_get() internally. When msm_gem_get_and_pin_iova() fails, the cursor_bo object is not properly released, leading to a memory leak. This issue stems from the original implementation in commit e172d10a9c4a which added hardware cursor support to the DRM MSM MDP5 driver (Kernel Commit).

The vulnerability can result in memory leaks in the Linux kernel when handling cursor operations in the MSM DRM driver. While the impact is limited to local attacks and requires low privileges, it could potentially lead to resource exhaustion over time (Red Hat).

The vulnerability has been patched by adding proper cleanup code to release the cursor_bo object when msm_gem_get_and_pin_iova() fails. The fix involves calling drm_gem_object_put() in the error path to prevent the memory leak (Kernel Commit).