CVE-2022-49871

MEDIUM EPSS 7.4%
Published May 1, 20251y ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published May 1, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: net: tun: Fix memory leaks of napi_get_frags kmemleak reports after running test_progs: unreferenced object 0xffff8881b1672dc0 (size 232): comm "test_progs", pid 394388, jiffies 4354712116 (age 841.975s) hex dump (first 32 bytes): e0 84 d7 a8 81 88 ff ff 80 2c 67 b1 81 88 ff ff .........,g..... 00 40 c5 9b 81 88 ff ff 00 00 00 00 00 00 00 00 .@.............. backtrace: [<00000000c8f01748>] napi_skb_cache_get+0xd4/0x150 [<0000000041c7fc09>] __napi_build_skb+0x15/0x50 [<00000000431c7079>] __napi_alloc_skb+0x26e/0x540 [<000000003ecfa30e>] napi_get_frags+0x59/0x140 [<0000000099b2199e>] tun_get_user+0x183d/0x3bb0 [tun] [<000000008a5adef0>] tun_chr_write_iter+0xc0/0x1b1 [tun] [<0000000049993ff4>] do_iter_readv_writev+0x19f/0x320 [<000000008f338ea2>] do_iter_write+0x135/0x630 [<000000008a3377a4>] vfs_writev+0x12e/0x440 [<00000000a6b5639a>] do_writev+0x104/0x280 [<00000000ccf065d8>] do_syscall_64+0x3b/0x90 [<00000000d776e329>] entry_SYSCALL_64_after_hwframe+0x63/0xcd The issue occurs in the following scenarios: tun_get_user() napi_gro_frags() napi_frags_finish() case GRO_NORMAL: gro_normal_one() list_add_tail(&skb->list, &napi->rx_list); <-- While napi->rx_count < READ_ONCE(gro_normal_batch), <-- gro_normal_list() is not called, napi->rx_list is not empty <-- not ask to complete the gro work, will cause memory leaks in <-- following tun_napi_del() ... tun_napi_del() netif_napi_del() __netif_napi_del() <-- &napi->rx_list is not empty, which caused memory leaks To fix, add napi_complete() after napi_gro_frags().

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
7.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-401

Affected Products 9

VendorProductVersionRange
linuxlinux_kernel*≥4.15  –  <4.19.267
linuxlinux_kernel*≥4.20  –  <5.4.225
linuxlinux_kernel*≥5.5  –  <5.10.155
linuxlinux_kernel*≥5.11  –  <5.15.79
linuxlinux_kernel*≥5.16  –  <6.0.9
linuxlinux_kernel6.1any
linuxlinux_kernel6.1any
linuxlinux_kernel6.1any
linuxlinux_kernel6.1any

References 6

  • git.kernel.org https://git.kernel.org/stable/c/1118b2049d77ca0b505775fc1a8d1909cf19a7ec
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/223ef6a94e52331a6a7ef31e59921e0e82d2d40a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3401f964028ac941425b9b2c8ff8a022539ef44a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8b12a020b20a78f62bedc50f26db3bf4fadf8cb9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a4f73f6adc53fd7a3f9771cbc89a03ef39b0b755
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d7569302a7a52a9305d2fb054df908ff985553bb
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/1118b2049d77ca0b505775fc1a8d1909cf19a7ec
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/223ef6a94e52331a6a7ef31e59921e0e82d2d40a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/3401f964028ac941425b9b2c8ff8a022539ef44a
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/8b12a020b20a78f62bedc50f26db3bf4fadf8cb9
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/a4f73f6adc53fd7a3f9771cbc89a03ef39b0b755
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d7569302a7a52a9305d2fb054df908ff985553bb
    Patch