ghsa-9rwv-33pv-xm7g
Vulnerability from github
In the Linux kernel, the following vulnerability has been resolved:
RISC-V: kexec: Fix memory leak of elf header buffer
This is reported by kmemleak detector:
unreferenced object 0xff2000000403d000 (size 4096): comm "kexec", pid 146, jiffies 4294900633 (age 64.792s) hex dump (first 32 bytes): 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 .ELF............ 04 00 f3 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000566ca97c>] kmemleak_vmalloc+0x3c/0xbe [<00000000979283d8>] __vmalloc_node_range+0x3ac/0x560 [<00000000b4b3712a>] __vmalloc_node+0x56/0x62 [<00000000854f75e2>] vzalloc+0x2c/0x34 [<00000000e9a00db9>] crash_prepare_elf64_headers+0x80/0x30c [<0000000067e8bf48>] elf_kexec_load+0x3e8/0x4ec [<0000000036548e09>] kexec_image_load_default+0x40/0x4c [<0000000079fbe1b4>] sys_kexec_file_load+0x1c4/0x322 [<0000000040c62c03>] ret_from_syscall+0x0/0x2
In elf_kexec_load(), a buffer is allocated via vzalloc() to store elf headers. While it's not freed back to system when kdump kernel is reloaded or unloaded, or when image->elf_header is successfully set and then fails to load kdump kernel for some reason. Fix it by freeing the buffer in arch_kimage_file_post_load_cleanup().
{
"affected": [],
"aliases": [
"CVE-2022-50765"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-24T13:16:03Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRISC-V: kexec: Fix memory leak of elf header buffer\n\nThis is reported by kmemleak detector:\n\nunreferenced object 0xff2000000403d000 (size 4096):\n comm \"kexec\", pid 146, jiffies 4294900633 (age 64.792s)\n hex dump (first 32 bytes):\n 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 .ELF............\n 04 00 f3 00 01 00 00 00 00 00 00 00 00 00 00 00 ................\n backtrace:\n [\u003c00000000566ca97c\u003e] kmemleak_vmalloc+0x3c/0xbe\n [\u003c00000000979283d8\u003e] __vmalloc_node_range+0x3ac/0x560\n [\u003c00000000b4b3712a\u003e] __vmalloc_node+0x56/0x62\n [\u003c00000000854f75e2\u003e] vzalloc+0x2c/0x34\n [\u003c00000000e9a00db9\u003e] crash_prepare_elf64_headers+0x80/0x30c\n [\u003c0000000067e8bf48\u003e] elf_kexec_load+0x3e8/0x4ec\n [\u003c0000000036548e09\u003e] kexec_image_load_default+0x40/0x4c\n [\u003c0000000079fbe1b4\u003e] sys_kexec_file_load+0x1c4/0x322\n [\u003c0000000040c62c03\u003e] ret_from_syscall+0x0/0x2\n\nIn elf_kexec_load(), a buffer is allocated via vzalloc() to store elf\nheaders. While it\u0027s not freed back to system when kdump kernel is\nreloaded or unloaded, or when image-\u003eelf_header is successfully set and\nthen fails to load kdump kernel for some reason. Fix it by freeing the\nbuffer in arch_kimage_file_post_load_cleanup().",
"id": "GHSA-9rwv-33pv-xm7g",
"modified": "2025-12-24T15:30:34Z",
"published": "2025-12-24T15:30:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50765"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/090bfcfc9f14d05154893c67eeaecc56e894fbae"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cbc32023ddbdf4baa3d9dc513a2184a84080a5a2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/cdea2da6787583ecca43594132533a2ac8d7cd21"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.