CVE-2022-50495
Description
A memory leak was found in the Linux kernel's Xen SMP interrupt initialization functions for x86 architectures. When interrupt handler binding fails during setup, the error path frees various resources but neglects to free dynamically allocated interrupt name strings created via kasprintf. This causes memory to leak with each failed initialization attempt, leading to resource exhaustion and denial of service.
Statement
The Xen SMP initialization code creates descriptive names for various inter-processor interrupts (IPIs) like reschedule, PMU, and call-function interrupts. These names are allocated dynamically using kasprintf and stored in local variables. When bind_ipi_to_irqhandler or bind_virq_to_irqhandler fails to register an interrupt handler, execution jumps to an error label that invokes xen_smp_intr_free (or xen_smp_intr_free_pv) to clean up. This cleanup releases the interrupt handlers themselves, but since the kasprintf-allocated strings were never stored in any structure that the cleanup function can access, they're simply abandoned in memory. Each initialization failure therefore leaks small amounts of memory—individually insignificant, but potentially problematic during repeated initialization cycles or in environments where Xen SMP setup repeatedly fails. The fix stores these strings where the cleanup path can find and free them.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other); DoS: Resource Consumption (Memory); DoS: Resource Consumption (CPU)
An attacker that can influence the allocation of resources that are not properly released could deplete the available resource pool and prevent all other processes from accessing the same type of resource. Frequently-affected resources include memory, CPU, disk space, power or battery, etc.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
