CVE-2022-50523
Description
A memory leak flaw was found in the Linux kernel's Rockchip clock driver in the PLL registration error path. A local user on systems with Rockchip hardware can trigger this issue when PLL clock registration fails, causing the driver to return without freeing memory previously allocated by kmemdup for the rate table. This results in a permanent memory leak that accumulates across registration failure cycles, leading to resource exhaustion and denial of service.
Statement
The rockchip_clk_register_pll function allocates memory for the PLL rate table using kmemdup early in the registration process. If the subsequent clk_register call fails, the function returns immediately without freeing the allocated rate table memory. Since clock registration failures are terminal errors that are not retried automatically, each failure permanently leaks memory. While clock registration typically occurs during boot and rarely fails, certain hardware configurations or deliberate manipulation of clock settings could trigger repeated failures. The issue requires Rockchip SoC hardware and conditions that cause clock registration to fail.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (Other)
An attacker that can influence the allocation of resources that are not properly maintained could deplete the available resource pool and prevent all other processes from accessing the same type of resource.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
