CVE-2022-50830

Vulnerability

Description

In the Linux kernel, the hd44780 driver for character LCD displays contains a memory leak in its hd44780_remove() function. During device driver allocates a memory chunk for the hd structure using kzalloc() during hd44780_probe(), and stores a pointer to it in lcd->drvdata->hd44780. However, when the driver is removed via hd44780_remove(), this allocated memory is not freed, leading to a memory leak [1].

Exploitation

This vulnerability is triggered during normal driver removal, such as when the associated hardware is unbound or the module is unloaded. No special privileges or network access are required; an attacker with local access to trigger driver removal (e.g., via hotplug or module unloading) could repeatedly cause the leak. The attack surface is limited to systems using the affected driver and where an attacker can influence device removal [1].

Impact

An attacker who can repeatedly trigger the hd44780_remove() path can exhaust kernel memory, potentially leading to denial of service (system instability or crash). The leak is per-removal event, so sustained exploitation could degrade system performance over time [1].

Mitigation

The fix is included in the Linux kernel stable tree as commit 5d407911e605702ffcc0e97a6db546592ab27dd0. Users should update to a kernel version containing this patch. No workaround is available other than avoiding driver removal on affected systems [1].