{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2022-49741", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-03-27T16:39:17.986Z", "datePublished": "2025-03-27T16:42:52.994Z", "dateUpdated": "2025-03-27T16:42:52.994Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2025-03-27T16:42:52.994Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: smscufx: fix error handling code in ufx_usb_probe\n\nThe current error handling code in ufx_usb_probe have many unmatching\nissues, e.g., missing ufx_free_usb_list, destroy_modedb label should\nonly include framebuffer_release, fb_dealloc_cmap only matches\nfb_alloc_cmap.\n\nMy local syzkaller reports a memory leak bug:\n\nmemory leak in ufx_usb_probe\n\nBUG: memory leak\nunreferenced object 0xffff88802f879580 (size 128):\n comm \"kworker/0:7\", pid 17416, jiffies 4295067474 (age 46.710s)\n hex dump (first 32 bytes):\n 80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff .!|.............\n 00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00 ................\n backtrace:\n [<ffffffff814c99a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045\n [<ffffffff824d219c>] kmalloc include/linux/slab.h:553 [inline]\n [<ffffffff824d219c>] kzalloc include/linux/slab.h:689 [inline]\n [<ffffffff824d219c>] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [inline]\n [<ffffffff824d219c>] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655\n [<ffffffff82d17927>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]\n [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639\n [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n [<ffffffff827132da>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:808\n [<ffffffff82713c27>] __device_attach_driver+0xf7/0x150 drivers/base/dd.c:936\n [<ffffffff82710137>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427\n [<ffffffff827136b5>] __device_attach+0x105/0x2d0 drivers/base/dd.c:1008\n [<ffffffff82711d36>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487\n [<ffffffff8270e242>] device_add+0x642/0xdc0 drivers/base/core.c:3517\n [<ffffffff82d14d5f>] usb_set_configuration+0x8ef/0xb80 drivers/usb/core/message.c:2170\n [<ffffffff82d2576c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238\n [<ffffffff82d16ffc>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293\n [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]\n [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639\n [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n\nFix this bug by rewriting the error handling code in ufx_usb_probe."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/video/fbdev/smscufx.c"], "versions": [{"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "3b3d3127f5b4291ae4caaf50f7b66089ad600480", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "3931014367ef31d26af65386a4ca496f50f0cfdf", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "64fa364ad3245508d393e16ed4886f92d7eb423c", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "1b4c08844628dfc8d72d3f51b657f2a5e63b7b4b", "status": "affected", "versionType": "git"}, {"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "b76449ee75e21acfe9fa4c653d8598f191ed7d68", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/video/fbdev/smscufx.c"], "versions": [{"version": "5.4.232", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.168", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.93", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.11", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/3b3d3127f5b4291ae4caaf50f7b66089ad600480"}, {"url": "https://git.kernel.org/stable/c/3931014367ef31d26af65386a4ca496f50f0cfdf"}, {"url": "https://git.kernel.org/stable/c/64fa364ad3245508d393e16ed4886f92d7eb423c"}, {"url": "https://git.kernel.org/stable/c/1b4c08844628dfc8d72d3f51b657f2a5e63b7b4b"}, {"url": "https://git.kernel.org/stable/c/b76449ee75e21acfe9fa4c653d8598f191ed7d68"}], "title": "fbdev: smscufx: fix error handling code in ufx_usb_probe", "x_generator": {"engine": "bippy-5f407fcff5a0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "B50AC354-4651-4CDE-8EA9-58A9A917F725", "versionEndExcluding": "5.4.232", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "12258A3F-04BD-49C9-9C6B-D3C1945E8910", "versionEndExcluding": "5.10.168", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "98FAC10E-42A0-4372-B1A0-A49CF672890E", "versionEndExcluding": "5.15.93", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "535D03F4-DA02-49FE-934E-668827E6407B", "versionEndExcluding": "6.1.11", "versionStartIncluding": "5.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfbdev: smscufx: fix error handling code in ufx_usb_probe\n\nThe current error handling code in ufx_usb_probe have many unmatching\nissues, e.g., missing ufx_free_usb_list, destroy_modedb label should\nonly include framebuffer_release, fb_dealloc_cmap only matches\nfb_alloc_cmap.\n\nMy local syzkaller reports a memory leak bug:\n\nmemory leak in ufx_usb_probe\n\nBUG: memory leak\nunreferenced object 0xffff88802f879580 (size 128):\n comm \"kworker/0:7\", pid 17416, jiffies 4295067474 (age 46.710s)\n hex dump (first 32 bytes):\n 80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff .!|.............\n 00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00 ................\n backtrace:\n [<ffffffff814c99a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045\n [<ffffffff824d219c>] kmalloc include/linux/slab.h:553 [inline]\n [<ffffffff824d219c>] kzalloc include/linux/slab.h:689 [inline]\n [<ffffffff824d219c>] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [inline]\n [<ffffffff824d219c>] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655\n [<ffffffff82d17927>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]\n [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639\n [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n [<ffffffff827132da>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:808\n [<ffffffff82713c27>] __device_attach_driver+0xf7/0x150 drivers/base/dd.c:936\n [<ffffffff82710137>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427\n [<ffffffff827136b5>] __device_attach+0x105/0x2d0 drivers/base/dd.c:1008\n [<ffffffff82711d36>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487\n [<ffffffff8270e242>] device_add+0x642/0xdc0 drivers/base/core.c:3517\n [<ffffffff82d14d5f>] usb_set_configuration+0x8ef/0xb80 drivers/usb/core/message.c:2170\n [<ffffffff82d2576c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238\n [<ffffffff82d16ffc>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293\n [<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]\n [<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639\n [<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n\nFix this bug by rewriting the error handling code in ufx_usb_probe."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fbdev: smscufx: corrige el c\u00f3digo de gesti\u00f3n de errores en ufx_usb_probe El c\u00f3digo de manejo de errores actual en ufx_usb_probe tiene muchos problemas que no coinciden, por ejemplo, falta ufx_free_usb_list, la etiqueta destroy_modedb solo debe incluir framebuffer_release, fb_dealloc_cmap solo coincide con fb_alloc_cmap. Mi syzkaller local informa de un error de p\u00e9rdida de memoria: p\u00e9rdida de memoria en ufx_usb_probe ERROR: p\u00e9rdida de memoria objeto no referenciado 0xffff88802f879580 (tama\u00f1o 128): comm \"kworker/0:7\", pid 17416, jiffies 4295067474 (edad 46.710s) volcado hexadecimal (primeros 32 bytes): 80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff .!|............. 00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00 ................ backtrace: [] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045 [] kmalloc include/linux/slab.h:553 [en l\u00ednea] [] kzalloc include/linux/slab.h:689 [en l\u00ednea] [] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [en l\u00ednea] [] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655 [] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [] sonda_de_controlador_de_llamada controladores/base/dd.c:560 [en l\u00ednea] [] sonda_realmente+0x12d/0x390 controladores/base/dd.c:639 [] dispositivo_sonda_de_controlador+0xbf/0x140 controladores/base/dd.c:778 [] dispositivo_sonda_de_controlador+0x2a/0x120 controladores/base/dd.c:808 [] controlador_adjunto_de_dispositivo+0xf7/0x150 controladores/base/dd.c:936 [] bus_para_cada_unidad+0xb7/0x100 controladores/base/bus.c:427 [] __adjunto_dispositivo+0x105/0x2d0 controladores/base/dd.c:1008 [] dispositivo_sonda_bus+0xc6/0xe0 controladores/base/bus.c:487 [] adici\u00f3n_dispositivo+0x642/0xdc0 controladores/base/n\u00facleo.c:3517 [] configuraci\u00f3n_establecida_usb+0x8ef/0xb80 controladores/usb/n\u00facleo/mensaje.c:2170 [] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 [] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 [] call_driver_probe drivers/base/dd.c:560 [en l\u00ednea] [] really_probe+0x12d/0x390 drivers/base/dd.c:639 [] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778 Corrija este error reescribiendo el c\u00f3digo de gesti\u00f3n de errores en ufx_usb_probe."}], "id": "CVE-2022-49741", "lastModified": "2025-04-14T20:26:41.627", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-03-27T17:15:38.720", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1b4c08844628dfc8d72d3f51b657f2a5e63b7b4b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3931014367ef31d26af65386a4ca496f50f0cfdf"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b3d3127f5b4291ae4caaf50f7b66089ad600480"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/64fa364ad3245508d393e16ed4886f92d7eb423c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b76449ee75e21acfe9fa4c653d8598f191ed7d68"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: fbdev: smscufx: fix error handling code in ufx_usb_probe", "id": "2355503", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2355503"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfbdev: smscufx: fix error handling code in ufx_usb_probe\nThe current error handling code in ufx_usb_probe have many unmatching\nissues, e.g., missing ufx_free_usb_list, destroy_modedb label should\nonly include framebuffer_release, fb_dealloc_cmap only matches\nfb_alloc_cmap.\nMy local syzkaller reports a memory leak bug:\nmemory leak in ufx_usb_probe\nBUG: memory leak\nunreferenced object 0xffff88802f879580 (size 128):\ncomm \"kworker/0:7\", pid 17416, jiffies 4295067474 (age 46.710s)\nhex dump (first 32 bytes):\n80 21 7c 2e 80 88 ff ff 18 d0 d0 0c 80 88 ff ff .!|.............\n00 d0 d0 0c 80 88 ff ff e0 ff ff ff 0f 00 00 00 ................\nbacktrace:\n[<ffffffff814c99a0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1045\n[<ffffffff824d219c>] kmalloc include/linux/slab.h:553 [inline]\n[<ffffffff824d219c>] kzalloc include/linux/slab.h:689 [inline]\n[<ffffffff824d219c>] ufx_alloc_urb_list drivers/video/fbdev/smscufx.c:1873 [inline]\n[<ffffffff824d219c>] ufx_usb_probe+0x11c/0x15a0 drivers/video/fbdev/smscufx.c:1655\n[<ffffffff82d17927>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396\n[<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]\n[<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639\n[<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\n[<ffffffff827132da>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:808\n[<ffffffff82713c27>] __device_attach_driver+0xf7/0x150 drivers/base/dd.c:936\n[<ffffffff82710137>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427\n[<ffffffff827136b5>] __device_attach+0x105/0x2d0 drivers/base/dd.c:1008\n[<ffffffff82711d36>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487\n[<ffffffff8270e242>] device_add+0x642/0xdc0 drivers/base/core.c:3517\n[<ffffffff82d14d5f>] usb_set_configuration+0x8ef/0xb80 drivers/usb/core/message.c:2170\n[<ffffffff82d2576c>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238\n[<ffffffff82d16ffc>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293\n[<ffffffff82712f0d>] call_driver_probe drivers/base/dd.c:560 [inline]\n[<ffffffff82712f0d>] really_probe+0x12d/0x390 drivers/base/dd.c:639\n[<ffffffff8271322f>] __driver_probe_device+0xbf/0x140 drivers/base/dd.c:778\nFix this bug by rewriting the error handling code in ufx_usb_probe."], "name": "CVE-2022-49741", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-03-27T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-49741\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-49741\nhttps://lore.kernel.org/linux-cve-announce/2025032757-CVE-2022-49741-65a7@gregkh/T"], "threat_severity": "Low"}