https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 11:08:11 +0000 https://vulnerability.circl.lu/vuln/cve-2022-49436 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>powerpc/papr_scm: Fix leaking nvdimm_events_map elements</p> <p>Right now &#39;char *&#39; elements allocated for individual &#39;stat_id&#39; in &#39;papr_scm_priv.nvdimm_events_map[]&#39; during papr_scm_pmu_check_events(), get leaked in papr_scm_remove() and papr_scm_pmu_register(), papr_scm_pmu_check_events() error paths.</p> <p>Also individual &#39;stat_id&#39; arent NULL terminated &#39;char *&#39; instead they are fixed 8-byte sized identifiers. However papr_scm_pmu_register() assumes it to be a NULL terminated &#39;char *&#39; and at other places it assumes it to be a &#39;papr_scm_perf_stat.stat_id&#39; sized string which is 8-byes in size.</p> <p>Fix this by allocating the memory for papr_scm_priv.nvdimm_events_map to also include space for &#39;stat_id&#39; entries. This is possible since number of available events/stat_ids are known upfront. This saves some memory and one extra level of indirection from &#39;nvdimm_events_map&#39; to &#39;stat_id&#39;. Also rest of the code can continue to call &#39;kfree(papr_scm_priv.nvdimm_events_map)&#39; without needing to iterate over the array and free up individual elements.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>powerpc/papr_scm: Fix leaking nvdimm_events_map elements</p> <p>Right now &#39;char *&#39; elements allocated for individual &#39;stat_id&#39; in &#39;papr_scm_priv.nvdimm_events_map[]&#39; during papr_scm_pmu_check_events(), get leaked in papr_scm_remove() and papr_scm_pmu_register(), papr_scm_pmu_check_events() error paths.</p> <p>Also individual &#39;stat_id&#39; arent NULL terminated &#39;char *&#39; instead they are fixed 8-byte sized identifiers. However papr_scm_pmu_register() assumes it to be a NULL terminated &#39;char *&#39; and at other places it assumes it to be a &#39;papr_scm_perf_stat.stat_id&#39; sized string which is 8-byes in size.</p> <p>Fix this by allocating the memory for papr_scm_priv.nvdimm_events_map to also include space for &#39;stat_id&#39; entries. This is possible since number of available events/stat_ids are known upfront. This saves some memory and one extra level of indirection from &#39;nvdimm_events_map&#39; to &#39;stat_id&#39;. Also rest of the code can continue to call &#39;kfree(papr_scm_priv.nvdimm_events_map)&#39; without needing to iterate over the array and free up individual elements.</p> https://vulnerability.circl.lu/vuln/cve-2022-49436