PT-2024-9262 · Linux+2 · Linux Kernel+2

Lang Yu · Published 2024-06-20 · Updated 2024-12-04 · CVE-2022-48731

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 5.15.0-custom #1

Description: The issue is related to the mm/kmemleak component of the Linux kernel, where a huge hole is created between node start pfn and node end pfn when using devm request free mem region and devm memremap pages to add ZONE DEVICE memory. This can cause a soft lockup due to busy test bit looping on the huge hole. The vulnerability was found on some AMD APUs where amdkfd requested a free mem region and created a huge hole.

Recommendations: To resolve the issue, update the Linux kernel to a version that includes the patch for the mm/kmemleak vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Memory Leak

Improper Locking

Weakness Enumeration

CWE-401

CWE-667

Related Identifiers

BDU:2024-10950

CVE-2022-48731

Affected Products

Astra Linux

Linux Kernel

Red Os

References · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48731.json · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-48731 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48731 · Vendor Advisory
• https://git.kernel.org/stable/c/c10a0f877fe007021d70f9cada240f42adc2b5db · Patch
• https://git.kernel.org/stable/c/a5389c80992f0001ee505838fe6a8b20897ce96e · Patch
• https://ubuntu.com/security/CVE-2022-48731 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-48731 · Vendor Advisory
• https://git.kernel.org/stable/c/cebb0aceb21ad91429617a40e3a17444fabf1529 · Patch
• https://git.kernel.org/stable/c/352715593e81b917ce1b321e794549815b850134 · Patch
• https://git.kernel.org/stable/c/d3533ee20e9a0e2e8f60384da7450d43d1c63d1a · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48731 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-48731 · Security Note
• https://bdu.fstec.ru/vul/2024-10950 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-48731 · Security Note
• https://redos.red-soft.ru/support/secure · Note