Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2022-49463
CVE-2022-49463:
Linux Kernel vulnerability analysis and mitigation
Overview
CVE-2022-49463 affects the Linux kernel's thermal driver subsystem, specifically in the imxscthermal driver. The vulnerability was discovered and reported on May 17, 2022, and involves a reference count leak in the imxscthermal_probe function. The issue affects various Linux distributions including Ubuntu 22.04 LTS (Jammy) (Ubuntu Security).
Technical details
The vulnerability stems from improper reference counting in the thermal/drivers/imxscthermal driver. Specifically, the offindnodebyname() function returns a node pointer with an incremented reference count, but the code failed to properly release this reference using ofnodeput() when done. This oversight was introduced in the commit that added i.MX system controller thermal support (Kernel Git).
Impact
The reference count leak in the imxscthermal driver could lead to memory resource exhaustion over time, potentially affecting system stability and performance (Ubuntu Security).
Mitigation and workarounds
The issue has been fixed by adding the missing ofnodeput() call to properly release the reference count. The fix was implemented in the Linux kernel through a patch that modifies the imxscthermal_probe function to ensure proper cleanup of resources (Kernel Git).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management