CVE-2022-50529
MEDIUMCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Description
In the Linux kernel, the following vulnerability has been resolved: test_firmware: fix memory leak in test_firmware_init() When misc_register() failed in test_firmware_init(), the memory pointed by test_fw_config->name is not released. The memory leak information is as follows: unreferenced object 0xffff88810a34cb00 (size 32): comm "insmod", pid 7952, jiffies 4294948236 (age 49.060s) hex dump (first 32 bytes): 74 65 73 74 2d 66 69 72 6d 77 61 72 65 2e 62 69 test-firmware.bi 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 n............... backtrace: [<ffffffff81b21fcb>] __kmalloc_node_track_caller+0x4b/0xc0 [<ffffffff81affb96>] kstrndup+0x46/0xc0 [<ffffffffa0403a49>] __test_firmware_config_init+0x29/0x380 [test_firmware] [<ffffffffa040f068>] 0xffffffffa040f068 [<ffffffff81002c41>] do_one_initcall+0x141/0x780 [<ffffffff816a72c3>] do_init_module+0x1c3/0x630 [<ffffffff816adb9e>] load_module+0x623e/0x76a0 [<ffffffff816af471>] __do_sys_finit_module+0x181/0x240 [<ffffffff89978f99>] do_syscall_64+0x39/0xb0 [<ffffffff89a0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Analysis
A memory leak vulnerability exists in the Linux kernel's test_firmware module initialization function (test_firmware_init) where allocated memory for test_fw_config->name is not properly freed when misc_register() fails. This affects all versions of the Linux kernel with the test_firmware module compiled, allowing local authenticated attackers to exhaust kernel memory and cause a denial of service. The vulnerability has a patch available from the Linux kernel maintainers, with an EPSS score of 0.01% indicating very low real-world exploitation probability despite the moderate CVSS score.
Technical Context
The vulnerability is classified as CWE-401 (Missing Release of Memory after Effective Lifetime), a memory management flaw in the Linux kernel's test_firmware driver. The test_firmware module is a kernel test driver used for firmware loading testing. The root cause occurs in the __test_firmware_config_init() function which uses kstrndup() to allocate memory for the configuration name string. When the subsequent misc_register() call fails, the error handling path does not call kfree() on the previously allocated test_fw_config->name pointer, resulting in a permanent memory leak. The leak is confirmed via kernel memory tracking that shows 32 bytes of unreferenced allocated memory containing the string 'test-firmware.bin'. The affected product is the Linux kernel itself (cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*), with multiple kernel versions affected as evidenced by patches available across multiple stable kernel branches.
Affected Products
All versions of the Linux kernel with the test_firmware module compiled are affected, as indicated by the CPE designation cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*. The vulnerability specifically impacts systems where test_firmware is enabled as a loadable module or compiled into the kernel. Patches have been made available across multiple Linux kernel stable branches through commits 04dd47a2e169f2d4489636afa07ff0469aab49ab, 0b5a89e8bce1ea43687742b4de8e216189ff94ac, 357379d504c0c8b0834e206ad8c49e4b3c98ed4d, 628de998a3abfffb3f9677d2fb39a1d5dcb32fdb, 6dd5fbd243f19f087dc79481acb7d69fb57fea2c, 7610615e8cdb3f6f5bbd9d8e7a5d8a63e3cabf2e, 8d8c1d6a430f0aadb80036e2b1bc0a05f9fad247, and ed5cbafaf7ce8b86f19998c00eb020c8d49b017f in the Linux kernel stable repository.
Remediation
Apply the latest kernel patch from the Linux kernel stable branch repositories at https://git.kernel.org/stable/ which includes the fix for the test_firmware memory leak (commits referenced above). For systems that cannot immediately patch, disable or remove the test_firmware module from the kernel configuration if it is not required for production use. If the test_firmware module must remain enabled, monitor kernel memory usage and system stability, as repeated module loading/unloading failures could lead to gradual memory exhaustion. The permanent remediation is to upgrade to a kernel version that includes one of the available patches, which properly releases allocated memory in the error handling path of test_firmware_init().
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today