CVE-2022-48723

spi: uniphier: fix reference count leak in uniphier_spi_probe()

Description

In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: fix reference count leak in uniphier_spi_probe() The issue happens in several error paths in uniphier_spi_probe(). When either dma_get_slave_caps() or devm_spi_register_master() returns an error code, the function forgets to decrease the refcount of both `dma_rx` and `dma_tx` objects, which may lead to refcount leaks. Fix it by decrementing the reference count of specific objects in those error paths.

5.5

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.05%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/e895e067d73e154b1ebc84a124e00831e311d9b0	patch
https://git.kernel.org/stable/c/dd00b4f8f768d81c3788a8ac88fdb3d745e55ea3	patch
https://git.kernel.org/stable/c/447c3d4046d7b54052d07d8b27e15e6edea5662c	patch
https://git.kernel.org/stable/c/37c2c83ca4f1ef4b6908181ac98e18360af89b42	patch

Frequently Asked Questions

What is the severity of CVE-2022-48723?: CVE-2022-48723 has been scored as a medium severity vulnerability.
How to fix CVE-2022-48723?: To fix CVE-2022-48723, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-48723 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2022-48723 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-48723?: CVE-2022-48723 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.