CVE-2022-50639

Vulnerability

In the Linux kernel's io-wq (I/O worker queue) implementation, a memory leak vulnerability exists in the worker creation path. When the io_wq_create function allocates an io_wqe struct for a node, but the subsequent CPU mask allocation for that node fails, the allocated memory for the io_wqe struct is not freed on the error handling path. This is because the io_wqe has not yet been added to the wqes array at that point, so the cleanup code does not release it [1].

Exploitation

The vulnerability can be triggered by invoking the io_uring_setup system call, which eventually calls io_wq_create. An attacker with the ability to make such system calls (e.g., a local user) can cause repeated allocation failures, leading to memory exhaustion. The issue was discovered via fuzzing with Syzkaller on kernel v6.1-rc1 [1].

Impact

An attacker can cause a memory leak, potentially leading to denial of service (system instability or crash) due to exhaustion of kernel memory. The leak is per failed allocation, and repeated exploitation can accumulate significant memory loss [1].

Mitigation

The fix is included in Linux kernel stable updates. The commit 996d3efeb091 addresses the issue by ensuring the io_wqe struct is freed if the CPU mask allocation fails after allocation [1]. Users should apply the latest kernel updates from their distribution.