CVE-2022-45887: Race Condition
An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusbdec.c has a memory leak because of the lack of a dvbfrontenddetach call.
Other sources
Linux Kernel is vulnerable to a denial of service, caused by a memory leak in drivers/media/usb/ttusb-dec/ttusbdec.c By sending a specially-crafted request, a local authenticated attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.133-1Fixed in 6.12.21-1Fixed in 6.12.22-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.4 - Configuration
Fix the memory leak by adding the missing dvb_frontend_detach call in drivers/media/usb/ttusb-dec/ttusb_dec.c (the issue is described as being caused by lack of a dvb_frontend_detach call).
Linux kernel (drivers/media/usb/ttusb-dec/ttusb_dec.c) dvb_frontend_detach call in ttusb_dec.c = Add missing dvb_frontend_detach call
Event History
Frequently Asked Questions
What is the severity of CVE-2022-45887?
CVE-2022-45887 has a medium severity due to its memory leak in the Linux kernel.
How do I fix CVE-2022-45887?
To fix CVE-2022-45887, upgrade the Linux kernel to version 6.4 or later.
Which products are affected by CVE-2022-45887?
CVE-2022-45887 affects Linux kernel versions up to 6.0.9, as well as certain IBM Security Verify Governance products.
Is there a workaround for CVE-2022-45887?
Currently, no official workaround is available for CVE-2022-45887 beyond applying the kernel updates.
What is the nature of the vulnerability in CVE-2022-45887?
CVE-2022-45887 involves a memory leak caused by a missing dvb_frontend_detach call in the Linux kernel.