CVE - CVE-2022-49890

CVE-ID
CVE-2022-49890	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: capabilities: fix potential memleak on error path from vfs_getxattr_alloc() In cap_inode_getsecurity(), we will use vfs_getxattr_alloc() to complete the memory allocation of tmpbuf, if we have completed the memory allocation of tmpbuf, but failed to call handler->get(...), there will be a memleak in below logic: \|-- ret = (int)vfs_getxattr_alloc(mnt_userns, ...) \| /* ^^^ alloc for tmpbuf / \|-- value = krealloc(xattr_value, error + 1, flags) \| /* ^^^ alloc memory / \|-- error = handler->get(handler, ...) \| / error! / \|-- xattr_value = value \| /* xattr_value is &tmpbuf (memory leak!) */ So we will try to free(tmpbuf) after vfs_getxattr_alloc() fails to fix it. [PM: subject line and backtrace tweaks]
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/0c3e6288da650d1ec911a259c77bc2d88e498603 URL:https://git.kernel.org/stable/c/0c3e6288da650d1ec911a259c77bc2d88e498603 MISC:https://git.kernel.org/stable/c/2de8eec8afb75792440b8900a01d52b8f6742fd1 URL:https://git.kernel.org/stable/c/2de8eec8afb75792440b8900a01d52b8f6742fd1 MISC:https://git.kernel.org/stable/c/6bb00eb21c0fbf18e5d3538c9ff0cf63fd0ace85 URL:https://git.kernel.org/stable/c/6bb00eb21c0fbf18e5d3538c9ff0cf63fd0ace85 MISC:https://git.kernel.org/stable/c/7480aeff0093d8c54377553ec6b31110bea37b4d URL:https://git.kernel.org/stable/c/7480aeff0093d8c54377553ec6b31110bea37b4d MISC:https://git.kernel.org/stable/c/8cf0a1bc12870d148ae830a4ba88cfdf0e879cee URL:https://git.kernel.org/stable/c/8cf0a1bc12870d148ae830a4ba88cfdf0e879cee MISC:https://git.kernel.org/stable/c/90577bcc01c4188416a47269f8433f70502abe98 URL:https://git.kernel.org/stable/c/90577bcc01c4188416a47269f8433f70502abe98 MISC:https://git.kernel.org/stable/c/cdf01c807e974048c43c7fd3ca574f6086a57906 URL:https://git.kernel.org/stable/c/cdf01c807e974048c43c7fd3ca574f6086a57906
Assigning CNA
kernel.org
Date Record Created
20250501	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250501)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)