CVE-2022-50646
In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix possible memory leak in hpsa_init_one() The hpda_alloc_ctlr_info() allocates h and its field reply_map. However, in hpsa_init_one(), if alloc_percpu() failed, the hpsa_init_one() jumps to clean1 directly, which frees h and leaks the h->reply_map. Fix by calling hpda_free_ctlr_info() to release h->replay_map and h instead free h directly.
Affected versions
Linux kernel versions
4.14.63,
4.16
and later are affected. Fixed in
4.19.270,
5.4.229,
5.10.163,
5.15.86,
6.0.16,
6.1.2,
6.2
and their respective stable series.
References
The following references provide additional information about CVE-2022-50646 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
PatchKernel patch commithttps://git.kernel.org/stable/c/0aa7be66168b1e84b2581ffff3ccb54a6c804a1e
-
PatchKernel patch commithttps://git.kernel.org/stable/c/9c9ff300e0de07475796495d86f449340d454a0c
-
PatchKernel patch commithttps://git.kernel.org/stable/c/bfe10a1d9fbccdf39f8449d62509f070d8aaaac1
Frequently asked questions
-
What is CVE-2022-50646?
CVE-2022-50646 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 4.14.63 onward and has been patched in 4.19.270, 5.4.229, 5.10.163 and others. CVE-2022-50646 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2022-50646?
Yes — CVE-2022-50646 has been patched. Fixed versions include 4.19.270, 5.4.229, 5.10.163 and others. If you are running Linux kernel 4.14.63 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2022-50646 actively exploited?
No — CVE-2022-50646 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.