CVE-2022-49661

can: gs_usb: gs_usb_open/close(): fix memory leak

published February 26, 2025

CVSS
—
EPSS
0%
Percentile
18.1
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

can: gs_usb: gs_usb_open/close(): fix memory leak

The gs_usb driver appears to suffer from a malady common to many USB

CAN adapter drivers in that it performs usb_alloc_coherent() to

allocate a number of USB request blocks (URBs) for RX, and then later

relies on usb_kill_anchored_urbs() to free them, but this doesn't

actually free them. As a result, this may be leaking DMA memory that's

been used by the driver.

This commit is an adaptation of the techniques found in the esd_usb2

driver where a similar design pattern led to a memory leak. It

explicitly frees the RX URBs and their DMA memory via a call to

usb_free_coherent(). Since the RX URBs were allocated in the

gs_can_open(), we remove them in gs_can_close() rather than in the

disconnect function as was done in esd_usb2.

For more information, see the 928150fad41b ("can: esd_usb2: fix memory

leak").

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00269 · 18.1th percentile
Published
2025-02-26T02:23Z
EPSS history
Timeline
  • 26 FEB 02:23Z
    can: gs_usb: gs_usb_open/close(): fix memory leak
    cvelistv5