CVE-2022-49436

In the Linux kernel, the following vulnerability has been resolved: powerpc/papr_scm: Fix leaking nvdimm_events_map elements Right now 'char *' elements allocated for individual 'stat_id' in 'papr_scm_priv.nvdimm_events_map[]' during papr_scm_pmu_check_events(), get leaked in papr_scm_remove() and papr_scm_pmu_register(), papr_scm_pmu_check_events() error paths. Also individual 'stat_id' arent NULL terminated 'char *' instead they are fixed 8-byte sized identifiers. However papr_scm_pmu_register() assumes it to be a NULL terminated 'char *' and at other places it assumes it to be a 'papr_scm_perf_stat.stat_id' sized string which is 8-byes in size. Fix this by allocating the memory for papr_scm_priv.nvdimm_events_map to also include space for 'stat_id' entries. This is possible since number of available events/stat_ids are known upfront. This saves some memory and one extra level of indirection from 'nvdimm_events_map' to 'stat_id'. Also rest of the code can continue to call 'kfree(papr_scm_priv.nvdimm_events_map)' without needing to iterate over the array and free up individual elements.

The following products are affected by CVE-2022-49436 vulnerability.

Here, you will find a curated list of external links that provide in-depth information to CVE-2022-49436.

URL	Resource
https://git.kernel.org/stable/c/0e0946e22f3665d27325d389ff45ade6e93f3678
https://git.kernel.org/stable/c/b073096df4dec70d0436321b7093bad27ae91f9e
https://lore.kernel.org/linux-cve-announce/2025022656-CVE-2022-49436-e924@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-49436
https://www.cve.org/CVERecord?id=CVE-2022-49436