CVE-2022-50046

net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change()

Description

In the Linux kernel, the following vulnerability has been resolved: net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change() The issue happens on some error handling paths. When the function fails to grab the object `xprt`, it simply returns 0, forgetting to decrease the reference count of another object `xps`, which is increased by rpc_sysfs_xprt_kobj_get_xprt_switch(), causing refcount leaks. Also, the function forgets to check whether `xps` is valid before using it, which may result in NULL-dereferencing issues. Fix it by adding proper error handling code when either `xprt` or `xps` is NULL.

N/A

CVSS

Severity:

EPSS 0.02%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/c0434f0e058648649250b8ed6078b66d773de723
https://git.kernel.org/stable/c/76fbeb1662b1c56514325118a07fba74dc4c79fe
https://git.kernel.org/stable/c/bfc48f1b0505ffcb03a6d749139b7577d6b81ae0

Frequently Asked Questions

What is the severity of CVE-2022-50046?: CVE-2022-50046 has not yet been assigned a CVSS score.
How to fix CVE-2022-50046?: To fix CVE-2022-50046, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-50046 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2022-50046 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-50046?: CVE-2022-50046 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.