CVE-2022-49718: 
Linux Debian vulnerability analysis and mitigation

CVE-2022-49718 is a vulnerability discovered in the Linux kernel affecting the irqchip/apple-aic component. The issue involves a reference count leak in the aic_of_ic_init function. The vulnerability was introduced through a missing of_node_put() call after using of_get_child_by_name(), which returns a node pointer with an incremented reference count (Kernel Git).

The vulnerability stems from a reference count leak in the Linux kernel's Apple Interrupt Controller (AIC) driver. Specifically, the aic_of_ic_init function failed to properly release the reference count on a device tree node obtained through of_get_child_by_name(). This was fixed by adding a missing of_node_put(affs) call to properly release the reference count. The fix was implemented in commit 3d45670fab3c25a7452721e4588cc95c51cda134 (Kernel Git).

The reference count leak could potentially lead to memory resource exhaustion over time as system resources are not properly freed. This affects systems using the Apple Interrupt Controller driver in the Linux kernel (Debian Tracker).

The vulnerability requires local access to the system and affects the kernel's interrupt controller driver for Apple devices. The issue was fixed in Linux kernel version 5.19-rc3 (Debian Tracker).

The vulnerability has been fixed in Linux kernel version 5.19-rc3 through the addition of the missing of_node_put() call. Users should upgrade to a patched kernel version that includes the fix. For Debian systems, fixed versions are available in bullseye (5.10.234-1) and bookworm (6.1.129-1) (Debian Tracker).