Bug 2320778 (CVE-2022-49011)

Summary:	CVE-2022-49011 kernel: hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	dfreiber, drow, jburrell, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A counting logic flaw exists in the Linux kernel. When ci_get_domain_bus_and_slot() is called, it returns a pci device with refcount incremented. When finishing it, the caller must decrement the reference count by calling pci_dev_put(), leading to the loss of confidentiality of the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2024-10-21 22:03:40 UTC

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()

As comment of pci_get_domain_bus_and_slot() says, it returns
a pci device with refcount increment, when finish using it,
the caller must decrement the reference count by calling
pci_dev_put(). So call it after using to avoid refcount leak.

Comment 1 Avinash Hanwate 2024-10-22 05:40:09 UTC

Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024102152-CVE-2022-49011-069a@gregkh/T

Comment 3 errata-xmlrpc 2025-05-14 00:23:48 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:7532 https://access.redhat.com/errata/RHSA-2025:7532

Comment 4 errata-xmlrpc 2025-05-14 00:33:04 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:7531 https://access.redhat.com/errata/RHSA-2025:7531