CVE-2022-50576

Vulnerability

Details

In the Linux kernel's serial pch driver, the function pch_request_dma() calls pci_get_slot() to obtain a PCI device, which increments the device's reference count. However, the function never decrements this count via pci_dev_put(), leading to a reference leak. This occurs on both normal and error paths, as noted in the commit message [1].

Exploitation

An attacker with local access could repeatedly trigger the DMA channel allocation, causing the leaked PCI device references to accumulate. Over time, this can exhaust kernel memory, leading to a denial-of-service condition. No special privileges other than the ability to interact with the serial device are required, though the attack is local in nature.

Impact

The vulnerability results in a memory leak of PCI device structures. While not directly exploitable for code execution, the resource exhaustion can cause system instability or crash. The CVSS score likely reflects a moderate severity due to the local attack vector and availability impact.

Mitigation

The fix was applied in Linux kernel stable releases via commits such as the one referenced in [1]. Users should update their kernels to include this patch or apply the corresponding stable updates.