PT-2025-8300 · Linux+1 · Linux Kernel+1

Xin Xiong · Publicado 2025-02-26 · Atualizado 2025-03-02 · CVE-2022-49366

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak issue has been identified in the Linux kernel, specifically in the ksmbd module. The problem occurs when the id and uid have the same value in the smb check perm dacl() function, causing the function to exit the loop without properly decrementing the reference count of the posix acls object. This can lead to memory leaks.

Recommendations For the affected Linux kernel versions, apply the fix by decreasing the reference count of posix acls before jumping to the label check access bits in the smb check perm dacl() function.

Exploit

Correção

Identificadores relacionados

CVE-2022-49366

Produtos afetados

Astra Linux

Linux Kernel

Referências · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49366.json · Exploit
• https://ubuntu.com/security/CVE-2022-49366 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49366 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2022-49366 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-49366 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1896037248409186564 · Publicação no Twitter
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=158612043 · Aviso do Fabricante
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Nota
• https://git.kernel.org/stable/c/248d71b440aef829f5cc5f6545ca113ef5062900 · Correção
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49366 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-49366 · Nota de Segurança
• https://git.kernel.org/stable/c/9758a6653c27867d810de02b4e5697163dda9883 · Correção
• https://git.kernel.org/stable/c/d21a580dafc69aa04f46e6099616146a536b0724 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49366 · Nota
• https://security-tracker.debian.org/tracker/CVE-2022-49366 · Aviso do Fabricante