CVE-2022-49902
📋 TL;DR
This CVE describes a memory leak vulnerability in the Linux kernel's block subsystem when device_add_disk() fails. The leak occurs because rq_wb memory allocated during writeback throttling initialization isn't properly freed in error paths. This affects Linux systems using block devices with writeback throttling enabled.
💻 Affected Systems
- Linux kernel
📦 What is this software?
Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →Linux Kernel by Linux
The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...
Learn more about Linux Kernel →⚠️ Risk & Real-World Impact
Worst Case
Sustained memory exhaustion leading to system instability, denial of service, or kernel panic if repeated failures occur in device initialization.
Likely Case
Minor memory leak during rare device initialization failures, unlikely to cause noticeable impact in most environments.
If Mitigated
No impact - memory is properly freed during normal operation or error handling.
🎯 Exploit Status
Exploitation requires triggering specific error conditions in kernel device initialization, typically requiring privileged access and specific hardware/configuration conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Kernel versions containing commits 4e68c5da60cd, 528677d3b4af, or fa81cbafbf57
Vendor Advisory: https://git.kernel.org/stable/c/4e68c5da60cd79950bd56287ae80b39d6261f995
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing the fix. 2. For distributions: Use package manager (apt/yum/dnf) to update kernel package. 3. Reboot system to load new kernel.
🔧 Temporary Workarounds
Disable writeback throttling
linuxDisable writeback throttling feature to prevent memory allocation in vulnerable code path
echo 0 > /sys/block/<device>/queue/wbt_lat_usec
🧯 If You Can't Patch
- Monitor system memory usage for unusual leaks during device operations
- Avoid loading/unloading block device drivers that might trigger the failure condition
🔍 How to Verify
Check if Vulnerable:
Check kernel version and compare with distribution's patched version list. Use 'uname -r' and check if version is before the fix.Check Version:
uname -rVerify Fix Applied:
Verify kernel version after update contains fix commits or is newer than vulnerable versions. Check with 'uname -r' and distribution security advisories.📡 Detection & Monitoring
Log Indicators:
- Kernel oops messages
- kmemleak reports of memory leaks in device_add_disk() or wbt_init()
- System logs showing device initialization failures
Network Indicators:
- None - local vulnerability only
SIEM Query:
Search for kernel panic logs, memory allocation failures, or device initialization errors in system logs