CVE-2022-49312

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8712: fix a potential memory leak in r871xu_drv_init()

In r871xu_drv_init(), if r8712_init_drv_sw() fails, then the memory

allocated by r8712_alloc_io_queue() in r8712_usb_dvobj_init() is not

properly released as there is no action will be performed by

r8712_usb_dvobj_deinit().

To properly release it, we should call r8712_free_io_queue() in

r8712_usb_dvobj_deinit().

Besides, in r871xu_dev_remove(), r8712_usb_dvobj_deinit() will be called

by r871x_dev_unload() under condition `padapter->bup` and

r8712_free_io_queue() is called by r8712_free_drv_sw().

However, r8712_usb_dvobj_deinit() does not rely on `padapter->bup` and

calling r8712_free_io_queue() in r8712_free_drv_sw() is negative for

better understading the code.

So I move r8712_usb_dvobj_deinit() into r871xu_dev_remove(), and remove

r8712_free_io_queue() from r8712_free_drv_sw().

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References