CVE-2022-50631

Vulnerability

In the Linux kernel, a memory leak vulnerability exists in the RISC-V architecture's kexec implementation. When loading a kexec kernel, a buffer is allocated via kvmalloc() to store the Flattened Device Tree (FDT). This buffer is not freed when the kexec kernel is reloaded or unloaded, resulting in a gradual memory leak. The issue was reported by the kmemleak detector, which identified unreferenced objects persisting after kexec operations [1].

Exploitation

An attacker with the ability to trigger repeated kexec operations (e.g., via the kexec_file_load syscall) can exploit this vulnerability to exhaust system memory. No authentication is required if the attacker has local access to the system. The leak occurs each time a kexec kernel is loaded, as the FDT buffer from the previous load is not reclaimed [2].

Impact

Over time, repeated kexec operations can lead to memory exhaustion, potentially causing system instability or denial of service (DoS). This could prevent legitimate processes from allocating memory, or even crash the system.

Mitigation

The fix introduces a RISC-V specific function arch_kimage_file_post_load_cleanup() that properly frees the FDT buffer when a kexec kernel is reloaded or unloaded. The patch has been applied to the stable kernel branches [1][2]. Users should update to the latest stable kernel to remediate the issue.