Bugzilla – Bug 1197646
VUL-0: CVE-2022-27950: kernel-source-rt,kernel-source,kernel-source-azure: Memory leak in drivers/hid/hid-elo.c
Last modified: 2022-04-05 07:21:41 UTC
rh#2069408 In drivers/hid/hid-elo.c in the Linux kernel before 5.16.11, a memory leak exists for a certain hid_parse error condition. Upstream fix commit: https://github.com/torvalds/linux/commit/817b8b9c5396d2b2d92311b46719aad5d3339dbe Commit introducing the bug: https://github.com/torvalds/linux/commit/fbf42729d0e91332e8ce75a1ecce08b8a2dab9c1 References: https://bugzilla.redhat.com/show_bug.cgi?id=2069408 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-27950 https://www.openwall.com/lists/oss-security/2022/03/13/1 https://github.com/torvalds/linux/commit/817b8b9c5396d2b2d92311b46719aad5d3339dbe http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27950 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=817b8b9c5396d2b2d92311b46719aad5d3339dbe https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=817b8b9c5396d2b2d92311b46719aad5d3339dbe https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.11 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fbf42729d0e91332e8ce75a1ecce08b8a2dab9c1
The buggy patch wasn't backported to any SLE branches, so it affected only stable branch. And stable branch got 5.16.x update and already moved to 5.17, i.e. already fixed. Reassigned back to security team.
Thanks Takashi for confirming! Closing