CVE-2022-49549

Summary

CVE-2022-49549 is a memory leak vulnerability affecting the Linux kernel. In the function mce_threshold_create_device(), if threshold_create_bank() fails, the previously allocated threshold banks array will leak due to an incorrect handling of pointers. Specifically, the call to mce_threshold_remove_device() does not free the allocated array when threshold_create_bank() fails, because the pointer to the array is written to bp only after the bank creation is successful. To mitigate this issue, a helper function has been added to unwind all bank creation work and free the previously allocated threshold banks array properly.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.