CVE-2022-49566

crypto: qat - fix memory leak in RSA

Description

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix memory leak in RSA When an RSA key represented in form 2 (as defined in PKCS #1 V2.1) is used, some components of the private key persist even after the TFM is released. Replace the explicit calls to free the buffers in qat_rsa_exit_tfm() with a call to qat_rsa_clear_ctx() which frees all buffers referenced in the TFM context.

References

Link	Tags
https://git.kernel.org/stable/c/a843925e0287eebb4aa808666bf22c664dfe4c53	patch
https://git.kernel.org/stable/c/0f967fdc09955221a1951a279481b0bf4d359941	patch
https://git.kernel.org/stable/c/80a52e1ee7757b742f96bfb0d58f0c14eb6583d0	patch

Frequently Asked Questions

What is the severity of CVE-2022-49566?: CVE-2022-49566 has been scored as a medium severity vulnerability.
How to fix CVE-2022-49566?: To fix CVE-2022-49566, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-49566 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2022-49566 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-49566?: CVE-2022-49566 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.

Description

Category

CWE-401 – Missing Release of Memory after Effective Lifetime

References

Frequently Asked Questions