CVE-2022-50545
📋 TL;DR
This is a memory leak vulnerability in the Linux kernel's r6040 network driver where phy_device objects aren't properly disconnected during error handling or device removal. It affects systems using the r6040 Ethernet driver, potentially leading to kernel memory exhaustion over time.
💻 Affected Systems
- Linux kernel with r6040 driver
⚠️ Risk & Real-World Impact
Worst Case
Sustained exploitation could exhaust kernel memory, leading to system instability, crashes, or denial of service requiring reboot.
Likely Case
Gradual memory leak during driver probe/remove cycles, eventually causing performance degradation or system instability.
If Mitigated
Minimal impact with proper monitoring and patching; memory leaks would be detected and addressed before causing issues.
🎯 Exploit Status
Requires ability to trigger driver probe/remove cycles; memory leak is gradual rather than immediate exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Linux kernel stable releases containing commits: 2ce242e1b9ad31c1f68496b3548e407a8cb2c07d, 3d5f83a62e8235d235534b3dc6f197d8a822c269, 5944c25c67de54e0aa53623e1e1af3bf8b16ed44, 7e43039a49c2da45edc1d9d7c9ede4003ab45a5f, 9b5b50329e2e966831a7237dd6949e7b5362a49a
Vendor Advisory: https://git.kernel.org/stable/c/2ce242e1b9ad31c1f68496b3548e407a8cb2c07d
Restart Required: Yes
Instructions:
1. Update Linux kernel to version containing fixes. 2. Reboot system. 3. Verify kernel version and that r6040 driver loads properly.
🔧 Temporary Workarounds
Disable r6040 driver
linuxPrevent loading of vulnerable driver if not needed
echo 'blacklist r6040' >> /etc/modprobe.d/blacklist.conf
rmmod r6040
Monitor kernel memory
linuxDetect memory leaks before they cause issues
watch -n 60 'cat /proc/meminfo | grep -E "Slab|SUnreclaim"'
🧯 If You Can't Patch
- Avoid unnecessary network interface changes that trigger driver probe/remove cycles
- Implement aggressive kernel memory monitoring and alerting for slab memory growth
🔍 How to Verify
Check if Vulnerable:
Check if r6040 driver is loaded: lsmod | grep r6040 AND check kernel version against patched versionsCheck Version:
uname -rVerify Fix Applied:
Verify kernel version includes fix commits AND test driver load/unload cycles while monitoring slab memory📡 Detection & Monitoring
Log Indicators:
- Kernel oom-killer messages
- System instability logs after network changes
- kmemleak reports if enabled
Network Indicators:
- None - this is a local memory issue
SIEM Query:
source="kernel" AND ("oom-killer" OR "slab" OR "memory leak")🔗 References
- https://git.kernel.org/stable/c/2ce242e1b9ad31c1f68496b3548e407a8cb2c07d
- https://git.kernel.org/stable/c/3d5f83a62e8235d235534b3dc6f197d8a822c269
- https://git.kernel.org/stable/c/5944c25c67de54e0aa53623e1e1af3bf8b16ed44
- https://git.kernel.org/stable/c/7e43039a49c2da45edc1d9d7c9ede4003ab45a5f
- https://git.kernel.org/stable/c/9b5b50329e2e966831a7237dd6949e7b5362a49a
- https://git.kernel.org/stable/c/a04707f4596952049da05756c27398c34d9a1d36
- https://git.kernel.org/stable/c/ad2c8f25457ca9a81e7e958148cbc26600ce3071
- https://git.kernel.org/stable/c/b0a61359026b57a287a48fbb4ba1d097023eca3e
- https://git.kernel.org/stable/c/b4448816e6a565e08236a6009c6bf48c6836cdfd
