CVE-2022-50723

Vulnerability

CVE-2022-50723 describes a memory leak in the Linux kernel's bnxt_en driver. The function bnxt_nvm_test() allocates a buffer using kmalloc() but fails to free it in the success path, leading to a memory leak [1].

Exploitation

An attacker with local access and the ability to trigger the bnxt_nvm_test() function on a system with an affected Broadcom NetXtreme NetXtreme network device could exploit this vulnerability. Repeated calls to the device via the netlink or ethtool interface may cause the kernel to leak memory over time [1].

Impact

The primary impact is a memory leak, which, if triggered repeatedly, could lead to system instability or denial of service due to resource exhaustion. There is no evidence of code execution or privilege escalation from this bug [1].

Mitigation

The fix was included in the Linux kernel stable tree, as seen in the commit referenced. Users should apply the kernel update from their distribution or vendor. There is no known public exploit code or CISA KEV listing [1].