CVE-2022-49627: ima: Fix potential memory leak in ima_init_crypto()
In the Linux kernel, the following vulnerability has been resolved:
ima: Fix potential memory leak in imainitcrypto()
On failure to allocate the SHA1 tfm, IMA fails to initialize and exits without freeing the imaalgoarray. Add the missing kfree() for imaalgoarray to avoid the potential memory leak.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In ima_init_crypto(), ensure that when allocation of the SHA1 tfm fails and IMA exits, the code frees ima_algo_array (add the missing kfree) to avoid the potential memory leak.
Linux kernel IMA (ima_init_crypto / ima_algo_array) memory management (add missing kfree) = kfree(ima_algo_array) on failure to allocate SHA1 tfm
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49627?
CVE-2022-49627 has been classified as a low-severity vulnerability due to the potential memory leak issue in the Linux kernel.
How do I fix CVE-2022-49627?
To fix CVE-2022-49627, upgrade to a version of the Linux kernel that contains the patch addressing the memory leak issue.
What versions of the Linux kernel are affected by CVE-2022-49627?
CVE-2022-49627 affects various versions of the Linux kernel from 5.8 to 5.19-rc6.
What impact does CVE-2022-49627 have on system performance?
CVE-2022-49627 may cause reduced system performance over time due to a possible memory leak.
Is CVE-2022-49627 a remote exploit risk?
CVE-2022-49627 does not represent a direct remote exploit risk as it requires local execution to trigger the memory leak.