GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49436 (GCVE-0-2022-49436)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:12 – Updated: 2026-05-11 18:59
VLAI
Title
powerpc/papr_scm: Fix leaking nvdimm_events_map elements
Summary
In the Linux kernel, the following vulnerability has been resolved: powerpc/papr_scm: Fix leaking nvdimm_events_map elements Right now 'char *' elements allocated for individual 'stat_id' in 'papr_scm_priv.nvdimm_events_map[]' during papr_scm_pmu_check_events(), get leaked in papr_scm_remove() and papr_scm_pmu_register(), papr_scm_pmu_check_events() error paths. Also individual 'stat_id' arent NULL terminated 'char *' instead they are fixed 8-byte sized identifiers. However papr_scm_pmu_register() assumes it to be a NULL terminated 'char *' and at other places it assumes it to be a 'papr_scm_perf_stat.stat_id' sized string which is 8-byes in size. Fix this by allocating the memory for papr_scm_priv.nvdimm_events_map to also include space for 'stat_id' entries. This is possible since number of available events/stat_ids are known upfront. This saves some memory and one extra level of indirection from 'nvdimm_events_map' to 'stat_id'. Also rest of the code can continue to call 'kfree(papr_scm_priv.nvdimm_events_map)' without needing to iterate over the array and free up individual elements.
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b , < b073096df4dec70d0436321b7093bad27ae91f9e (git)
Affected: 4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b , < 0e0946e22f3665d27325d389ff45ade6e93f3678 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 5.18.3 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/platforms/pseries/papr_scm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b073096df4dec70d0436321b7093bad27ae91f9e",
              "status": "affected",
              "version": "4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b",
              "versionType": "git"
            },
            {
              "lessThan": "0e0946e22f3665d27325d389ff45ade6e93f3678",
              "status": "affected",
              "version": "4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "arch/powerpc/platforms/pseries/papr_scm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/papr_scm: Fix leaking nvdimm_events_map elements\n\nRight now \u0027char *\u0027 elements allocated for individual \u0027stat_id\u0027 in\n\u0027papr_scm_priv.nvdimm_events_map[]\u0027 during papr_scm_pmu_check_events(), get\nleaked in papr_scm_remove() and papr_scm_pmu_register(),\npapr_scm_pmu_check_events() error paths.\n\nAlso individual \u0027stat_id\u0027 arent NULL terminated \u0027char *\u0027 instead they are fixed\n8-byte sized identifiers. However papr_scm_pmu_register() assumes it to be a\nNULL terminated \u0027char *\u0027 and at other places it assumes it to be a\n\u0027papr_scm_perf_stat.stat_id\u0027 sized string which is 8-byes in size.\n\nFix this by allocating the memory for papr_scm_priv.nvdimm_events_map to also\ninclude space for \u0027stat_id\u0027 entries. This is possible since number of available\nevents/stat_ids are known upfront. This saves some memory and one extra level of\nindirection from \u0027nvdimm_events_map\u0027 to \u0027stat_id\u0027. Also rest of the code\ncan continue to call \u0027kfree(papr_scm_priv.nvdimm_events_map)\u0027 without needing to\niterate over the array and free up individual elements."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:59:47.036Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b073096df4dec70d0436321b7093bad27ae91f9e"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e0946e22f3665d27325d389ff45ade6e93f3678"
        }
      ],
      "title": "powerpc/papr_scm: Fix leaking nvdimm_events_map elements",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49436",
    "datePublished": "2025-02-26T02:12:52.044Z",
    "dateReserved": "2025-02-26T02:08:31.570Z",
    "dateUpdated": "2026-05-11T18:59:47.036Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49436",
      "date": "2026-09-16",
      "epss": "0.00218",
      "percentile": "0.12404"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49436\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:20.057\",\"lastModified\":\"2026-06-17T05:18:02.613\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\npowerpc/papr_scm: Fix leaking nvdimm_events_map elements\\n\\nRight now \u0027char *\u0027 elements allocated for individual \u0027stat_id\u0027 in\\n\u0027papr_scm_priv.nvdimm_events_map[]\u0027 during papr_scm_pmu_check_events(), get\\nleaked in papr_scm_remove() and papr_scm_pmu_register(),\\npapr_scm_pmu_check_events() error paths.\\n\\nAlso individual \u0027stat_id\u0027 arent NULL terminated \u0027char *\u0027 instead they are fixed\\n8-byte sized identifiers. However papr_scm_pmu_register() assumes it to be a\\nNULL terminated \u0027char *\u0027 and at other places it assumes it to be a\\n\u0027papr_scm_perf_stat.stat_id\u0027 sized string which is 8-byes in size.\\n\\nFix this by allocating the memory for papr_scm_priv.nvdimm_events_map to also\\ninclude space for \u0027stat_id\u0027 entries. This is possible since number of available\\nevents/stat_ids are known upfront. This saves some memory and one extra level of\\nindirection from \u0027nvdimm_events_map\u0027 to \u0027stat_id\u0027. Also rest of the code\\ncan continue to call \u0027kfree(papr_scm_priv.nvdimm_events_map)\u0027 without needing to\\niterate over the array and free up individual elements.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: powerpc/papr_scm: Se soluciona la fuga de elementos nvdimm_events_map En este momento, los elementos \u0027char *\u0027 asignados para el individuo \u0027stat_id\u0027 en \u0027papr_scm_priv.nvdimm_events_map[]\u0027 durante papr_scm_pmu_check_events(), se filtran en las rutas de error papr_scm_remove() y papr_scm_pmu_register(), papr_scm_pmu_check_events(). Adem\u00e1s, los \u0027stat_id\u0027 individuales no son \u0027char *\u0027 terminados en NULL, sino que son identificadores fijos de tama\u00f1o de 8 bytes. Sin embargo, papr_scm_pmu_register() asume que es un \u0027char *\u0027 terminado en NULL y en otros lugares asume que es una cadena de tama\u00f1o \u0027papr_scm_perf_stat.stat_id\u0027 que tiene un tama\u00f1o de 8 bytes. Solucione este problema asignando la memoria para papr_scm_priv.nvdimm_events_map para que tambi\u00e9n incluya espacio para las entradas \u0027stat_id\u0027. Esto es posible ya que la cantidad de eventos/stat_id disponibles se conoce de antemano. Esto ahorra algo de memoria y un nivel adicional de indirecci\u00f3n de \u0027nvdimm_events_map\u0027 a \u0027stat_id\u0027. Adem\u00e1s, el resto del c\u00f3digo puede continuar llamando a \u0027kfree(papr_scm_priv.nvdimm_events_map)\u0027 sin necesidad de iterar sobre la matriz y liberar elementos individuales.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"arch/powerpc/platforms/pseries/papr_scm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b\",\"lessThan\":\"b073096df4dec70d0436321b7093bad27ae91f9e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4c08d4bbc089a95f3f38389c2b79dbc6ab24f10b\",\"lessThan\":\"0e0946e22f3665d27325d389ff45ade6e93f3678\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"arch/powerpc/platforms/pseries/papr_scm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18.3\",\"lessThanOrEqual\":\"5.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"5.18.3\",\"matchCriteriaId\":\"8E122216-2E9E-4B3E-B7B8-D575A45BA3C2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0e0946e22f3665d27325d389ff45ade6e93f3678\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b073096df4dec70d0436321b7093bad27ae91f9e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:37:38+00:00",
      "cve": "CVE-2022-49436",
      "id": "CVE-2022-49436",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: powerpc/papr_scm: Fix leaking nvdimm_events_map elements",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49436.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:31:16Z",
      "cve": "CVE-2022-49436",
      "id": "CVE-2022-49436",
      "initial_release_date": "2025-02-27T03:06:57Z",
      "product_status:known_affected": "364",
      "product_status:known_not_affected": "409",
      "product_status:recommended": "100",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49436",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49436.json",
      "version": "33"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.