CVE-2022-49432: powerpc/xics: fix refcount leak in icp_opal_init()
In the Linux kernel, the following vulnerability has been resolved:
powerpc/xics: fix refcount leak in icpopalinit()
The offindcompatiblenode() function returns a node pointer with refcount incremented, use ofnodeput() on it when done.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch powerpc/xics: fix refcount leak in icp_opal_init()
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49432?
CVE-2022-49432 is classified as a medium severity vulnerability due to its potential to cause a refcount leak.
How do I fix CVE-2022-49432?
To fix CVE-2022-49432, update your Linux kernel to a version beyond the affected ranges listed in the CVE.
Which versions of the Linux kernel are affected by CVE-2022-49432?
CVE-2022-49432 affects Linux kernel versions prior to 4.9.318 and those between 4.10 and 5.18.3.
What is the nature of the vulnerability in CVE-2022-49432?
CVE-2022-49432 involves a refcount leak in the icp_opal_init() function within the powerpc/xics subsystem.
Is CVE-2022-49432 exploitable by remote attackers?
CVE-2022-49432 does not appear to be directly exploitable by remote attackers, as it primarily concerns local privilege escalation.