CVE-2022-50316
BaseFortify
Publication date: 2025-09-15
Last updated on: 2025-12-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 4.6 (inc) to 6.0.16 (exc) |
| linux | linux_kernel | From 6.1 (inc) to 6.1.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-401 | The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a memory leak in the Linux kernel's orangefs module. Specifically, when the orangefs module is inserted and removed, certain kernel objects (kobjects) are not properly freed, causing memory to be leaked. This issue occurs in the orangefs_sysfs_init() function, where allocated memory is not correctly released during module initialization and cleanup.
How can this vulnerability impact me? :
The memory leak caused by this vulnerability can lead to increased memory usage over time when the orangefs module is repeatedly inserted and removed. This can degrade system performance and potentially cause resource exhaustion, which might lead to system instability or crashes if the leak is significant and persistent.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves memory leaks of kobjects when inserting and removing the orangefs module in the Linux kernel. Detection can be done by monitoring kernel memory leaks related to orangefs module operations. You can use the 'kmemleak' feature in the Linux kernel to detect such leaks. To enable and check for kmemleak reports, you can use the following commands: 1. Enable kmemleak (if not already enabled): echo scan > /sys/kernel/debug/kmemleak 2. Check for kmemleak reports: cat /sys/kernel/debug/kmemleak 3. Insert and remove the orangefs module: sudo modprobe orangefs sudo modprobe -r orangefs 4. After module operations, check kmemleak again for unreferenced objects related to orangefs. These steps help detect the memory leak caused by the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update your Linux kernel to a version where the orangefs module's kmemleak issue has been fixed. Avoid inserting and removing the orangefs module until the patch is applied. If updating is not immediately possible, monitor for memory leaks using kmemleak and consider disabling the orangefs module to prevent exploitation of the memory leak.