CVE-2022-49627

MEDIUM

Linux Kernel 5.8-5.10.131, 5.11-5.15.55, 5.16-5.18.12 - Use-After-Free in IMA Crypto Initialization

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: ima: Fix potential memory leak in ima_init_crypto() On failure to allocate the SHA1 tfm, IMA fails to initialize and exits without freeing the ima_algo_array. Add the missing kfree() for ima_algo_array to avoid the potential memory leak.

References (4)

Core 4

Scores

CVSS v3 5.5
EPSS 0.0025
EPSS Percentile 15.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-401
Status published
Products (15)
linux/Kernel 5.11.0 - 5.15.56linux
linux/Kernel 5.16.0 - 5.18.13linux
linux/Kernel 5.8.0 - 5.10.132linux
Linux/Linux < 5.8
Linux/Linux 5.10.132 - 5.10.*
Linux/Linux 5.15.56 - 5.15.*
Linux/Linux 5.18.13 - 5.18.*
Linux/Linux 5.19
Linux/Linux 5.8
Linux/Linux 6d94809af6b0830c4dfcad661535a5939bcb8a7d - 067d2521874135267e681c19d42761c601d503d6
... and 5 more
Published Feb 26, 2025
Tracked Since Feb 18, 2026