CVE-2022-49636

Summary

CVE-2022-49636: A memory leak issue was identified in the Linux kernel's VLAN subsystem. When vlan_changelink() fails to allocate memory in vlan_newlink(), prior memory allocations remain unreferenced and unfree. This vulnerability could potentially lead to a Denial of Service (DoS) attack, as an attacker could exhaust available memory by repeatedly triggering the memory allocation failure. The affected functions are vlan_dev_set_egress_priority, vlan_changelink, and vlan_newlink. The kernel's netlink subsystem is also affected, as it relies on these functions to create and modify VLAN interfaces. The root cause of the issue was a bug re-introduced in a later commit that had previously been fixed.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.