CVE-2022-50765

Vulnerability

In the Linux kernel's RISC-V architecture, the elf_kexec_load() function allocates a buffer via vzalloc() to store ELF headers for kexec/kdump operations. This buffer is not freed when the kdump kernel is reloaded or unloaded, or when the image's elf_header is successfully set but the kdump kernel subsequently fails to load. This leads to a memory leak, as reported by the kmemleak detector [1].

Exploitation

The vulnerability is triggered during normal kexec operations, specifically when a user performs a kexec file load (via the sys_kexec_file_load syscall) and then either reloads, unloads, or encounters a failure after setting the ELF headers. No special privileges beyond those required to execute kexec are needed, but the attacker must have the ability to trigger these operations on a RISC-V system.

Impact

An attacker who can repeatedly trigger kexec operations can exhaust kernel memory by leaking 4 KB (the size of the ELF header buffer) per operation. This could lead to denial of service (system instability or crash) due to memory exhaustion. The leak is limited to the RISC-V architecture and affects systems using kexec/kdump.

Mitigation

The fix is included in Linux kernel stable commit 090bfcfc9f14, which frees the buffer in arch_kimage_file_post_load_cleanup(). Users should apply the patch or update to a kernel version containing this fix. No workaround is available other than avoiding repeated kexec operations on unpatched systems.