CVE-2022-48650CWE-401

CVE-2022-48650

Medium · published April 28, 2024

CVSS v3.1
4.7
EPSS
0%
Percentile
12.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts()

Commit 8f394da36a36 ("scsi: qla2xxx: Drop TARGET_SCF_LOOKUP_LUN_FROM_TAG")

made the __qlt_24xx_handle_abts() function return early if

tcm_qla2xxx_find_cmd_by_tag() didn't find a command, but it missed to clean

up the allocated memory for the management command.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00229 · 12.9th percentile
Weakness
CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2024-04-28T17:15Z
Affected products (8)
ProductVersionsFixed in
linux/linux_kernel≥ 5.11, < 5.15.715.15.71
linux/linux_kernel≥ 5.16, < 5.19.125.19.12
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (7)
https://git.kernel.org/stable/c/29a22a3d495c147117137719d2c39045c44ccebf · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/601be20fc6a1b762044d2398befffd6bf236cebf · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6a4236ed47f5b0a57eb6b8fb1c351b15b3d341d7 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/89df49e561b4a8948521fc3f8a013012eaa08f82 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/601be20fc6a1b762044d2398befffd6bf236cebf · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/6a4236ed47f5b0a57eb6b8fb1c351b15b3d341d7 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/89df49e561b4a8948521fc3f8a013012eaa08f82 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 28 APR 13:00Z
    scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts()
    cvelistv5