CVE-2022-49676

memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings

Description

In the Linux kernel, the following vulnerability has been resolved: memory: samsung: exynos5422-dmc: Fix refcount leak in of_get_dram_timings of_parse_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. This function doesn't call of_node_put() in some error paths. To unify the structure, Add put_node label and goto it on errors.

5.5

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 0.02%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/889aad2203e09eed2071ca8985c25e9d6aea5735	patch
https://git.kernel.org/stable/c/cde4480b5ab06195b9164184b0c02ced71e601b4	patch
https://git.kernel.org/stable/c/bb2a481778c60f912c363e271ae46b55ff8132db	patch
https://git.kernel.org/stable/c/1332661e09304b7b8e84e5edc11811ba08d12abe	patch

Frequently Asked Questions

What is the severity of CVE-2022-49676?: CVE-2022-49676 has been scored as a medium severity vulnerability.
How to fix CVE-2022-49676?: To fix CVE-2022-49676, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-49676 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2022-49676 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-49676?: CVE-2022-49676 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.