PT-2025-8300 · Linux+1 · Linux Kernel+1

Xin Xiong · Published 2025-02-26 · Updated 2025-03-02 · CVE-2022-49366

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A memory leak issue has been identified in the Linux kernel, specifically in the ksmbd module. The problem occurs when the id and uid have the same value in the smb check perm dacl() function, causing the function to exit the loop without properly decrementing the reference count of the posix acls object. This can lead to memory leaks.

Recommendations For the affected Linux kernel versions, apply the fix by decreasing the reference count of posix acls before jumping to the label check access bits in the smb check perm dacl() function.

Exploit

Fix

Related Identifiers

CVE-2022-49366

Affected Products

Astra Linux

Linux Kernel

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49366.json · Exploit
• https://ubuntu.com/security/CVE-2022-49366 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49366 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-49366 · Security Note
• https://osv.dev/vulnerability/CVE-2022-49366 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=158612043 · Vendor Advisory
• https://git.kernel.org/stable/c/248d71b440aef829f5cc5f6545ca113ef5062900 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49366 · Security Note
• https://git.kernel.org/stable/c/9758a6653c27867d810de02b4e5697163dda9883 · Patch
• https://git.kernel.org/stable/c/d21a580dafc69aa04f46e6099616146a536b0724 · Patch
• https://security-tracker.debian.org/tracker/CVE-2022-49366 · Vendor Advisory
• https://git.kernel.org/stable/c/cf824b95c12a1abacadbc2d069931963221a3414 · Patch
• https://twitter.com/CVEnew/status/1896037248409186564 · Twitter Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note