Linux Kernel up to 5.15.21/5.16.7 RDMA siw_create_qp reference count

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.15.21/5.16.7. It has been rated as critical. Affected is the function siw_create_qp of the component RDMA. The manipulation leads to reference count. This vulnerability is listed as CVE-2022-48725. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.15.21/5.16.7 and classified as critical. This issue affects the function siw_create_qp of the component RDMA. The manipulation with an unknown input leads to a reference count vulnerability. Using CWE to declare the problem leads to CWE-911. The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count. Impacted is availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix refcounting leak in siw_create_qp() The atomic_inc() needs to be paired with an atomic_dec() on the error path.

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2022-48725. Technical details are known, but no exploit is available.

Upgrading to version 5.15.22 or 5.16.8 eliminates this vulnerability. Applying the patch 2989ba9532ba/fa3b844a5084/a75badebfdc0 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.16.0
• 5.16.1
• 5.16.2
• 5.16.3
• 5.16.4
• 5.16.5
• 5.16.6
• 5.16.7

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion