CVE - CVE-2022-49648

CVE-ID
CVE-2022-49648	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Fix memory leak problem This reverts commit 46bbe5c671e06f070428b9be142cc4ee5cedebac. As commit 46bbe5c671e0 ("tracing: fix double free") said, the "double free" problem reported by clang static analyzer is: > In parse_var_defs() if there is a problem allocating > var_defs.expr, the earlier var_defs.name is freed. > This free is duplicated by free_var_defs() which frees > the rest of the list. However, if there is a problem allocating N-th var_defs.expr: + in parse_var_defs(), the freed 'earlier var_defs.name' is actually the N-th var_defs.name; + then in free_var_defs(), the names from 0th to (N-1)-th are freed; IF ALLOCATING PROBLEM HAPPENED HERE!!! -+ \ \| 0th 1th (N-1)-th N-th V +-------------+-------------+-----+-------------+----------- var_defs: \| name \| expr \| name \| expr \| ... \| name \| expr \| name \| /// +-------------+-------------+-----+-------------+----------- These two frees don't act on same name, so there was no "double free" problem before. Conversely, after that commit, we get a "memory leak" problem because the above "N-th var_defs.name" is not freed. If enable CONFIG_DEBUG_KMEMLEAK and inject a fault at where the N-th var_defs.expr allocated, then execute on shell like: $ echo 'hist:key=call_site:val=$v1,$v2:v1=bytes_req,v2=bytes_alloc' > \ /sys/kernel/debug/tracing/events/kmem/kmalloc/trigger Then kmemleak reports: unreferenced object 0xffff8fb100ef3518 (size 8): comm "bash", pid 196, jiffies 4295681690 (age 28.538s) hex dump (first 8 bytes): 76 31 00 00 b1 8f ff ff v1...... backtrace: [<0000000038fe4895>] kstrdup+0x2d/0x60 [<00000000c99c049a>] event_hist_trigger_parse+0x206f/0x20e0 [<00000000ae70d2cc>] trigger_process_regex+0xc0/0x110 [<0000000066737a4c>] event_trigger_write+0x75/0xd0 [<000000007341e40c>] vfs_write+0xbb/0x2a0 [<0000000087fde4c2>] ksys_write+0x59/0xd0 [<00000000581e9cdf>] do_syscall_64+0x3a/0x80 [<00000000cf3b065c>] entry_SYSCALL_64_after_hwframe+0x46/0xb0
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/22eeff55679d9e7c0f768c79bfbd83e2f8142d89 URL:https://git.kernel.org/stable/c/22eeff55679d9e7c0f768c79bfbd83e2f8142d89 MISC:https://git.kernel.org/stable/c/4d453eb5e1eec89971aa5b3262857ee26cfdffd3 URL:https://git.kernel.org/stable/c/4d453eb5e1eec89971aa5b3262857ee26cfdffd3 MISC:https://git.kernel.org/stable/c/78a1400c42ee11197eb1f0f85ba51df9a4fdfff0 URL:https://git.kernel.org/stable/c/78a1400c42ee11197eb1f0f85ba51df9a4fdfff0 MISC:https://git.kernel.org/stable/c/7edc3945bdce9c39198a10d6129377a5c53559c2 URL:https://git.kernel.org/stable/c/7edc3945bdce9c39198a10d6129377a5c53559c2 MISC:https://git.kernel.org/stable/c/eb622d5580b9e2ff694f62da6410618bd73853cb URL:https://git.kernel.org/stable/c/eb622d5580b9e2ff694f62da6410618bd73853cb MISC:https://git.kernel.org/stable/c/ecc6dec12c33aa92c086cd702af9f544ddaf3c75 URL:https://git.kernel.org/stable/c/ecc6dec12c33aa92c086cd702af9f544ddaf3c75
Assigning CNA
kernel.org
Date Record Created
20250226	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250226)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)