CVE-2022-50201

selinux: fix memleak in security_read_state_kernel()

Description

In the Linux kernel, the following vulnerability has been resolved: selinux: fix memleak in security_read_state_kernel() In this function, it directly returns the result of __security_read_policy without freeing the allocated memory in *data, cause memory leak issue, so free the memory if __security_read_policy failed. [PM: subject line tweak]

N/A

CVSS

Severity:

EPSS 0.02%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/c877c5217145bda8fd95f506bf42f8d981afa57d
https://git.kernel.org/stable/c/f3cd7562c0a6774fc62d79654482014020e574f5
https://git.kernel.org/stable/c/1fc1f72aad2070d34022d0823e4cf09706b53f25
https://git.kernel.org/stable/c/73de1befcc53a7c68b0c5e76b9b5ac41c517760f

Frequently Asked Questions

What is the severity of CVE-2022-50201?: CVE-2022-50201 has not yet been assigned a CVSS score.
How to fix CVE-2022-50201?: To fix CVE-2022-50201, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2022-50201 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2022-50201 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-50201?: CVE-2022-50201 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.