CVE-2022-47941

Published: Dec 23, 2022Modified: Apr 15, 2025

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c omits a kfree call in certain smb2_handle_negotiate error conditions, aka a memory leak.

Affected (3)

Products: Linux: Linux Kernel

Linux

1 product

Linux Kernel

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Linux Linux Kernel	From 5.15 to 5.15.61
Linux Linux Kernel	From 5.16 to 5.18.18
Linux Linux Kernel	From 5.19 to 5.19.2

Related CWEs

CWE-401

Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.

References (10)

http://www.openwall.com/lists/oss-security/2022/12/23/10

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19.2

Source: cve@mitre.org

Mailing ListPatchVendor Advisory

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=aa7253c2393f6dcd6a1468b0792f6da76edad917

Source: cve@mitre.org

Mailing ListPatchVendor Advisory

https://github.com/torvalds/linux/commit/aa7253c2393f6dcd6a1468b0792f6da76edad917

Source: cve@mitre.org

PatchThird Party Advisory

https://www.zerodayinitiative.com/advisories/ZDI-22-1687/

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.openwall.com/lists/oss-security/2022/12/23/10