CVE-2022-50474

Description

In the Linux kernel, the following vulnerability has been resolved: macintosh: fix possible memory leak in macio_add_one_device() Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array"), the name of device is allocated dynamically. It needs to be freed when of_device_register() fails. Call put_device() to give up the reference that's taken in device_initialize(), so that it can be freed in kobject_cleanup() when the refcount hits 0. macio device is freed in macio_release_dev(), so the kfree() can be removed.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux kernel < 5.10 (含macintosh/macio子系统的所有受影响版本)

Linux kernel 5.10.x（需检查具体子版本）

Linux kernel 5.15.x（需检查具体子版本）

Linux kernel 5.18+（需检查具体子版本）

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

// CVE-2022-50474 PoC - Linux Kernel macio Memory Leak
// This PoC demonstrates the memory leak by repeatedly triggering
// macio device registration failure condition

#include <linux/module.h>
#include <linux/init.h>
#include <linux/of.h>
#include <linux/platform_device.h>
#include <linux/slab.h>

// Simulate the vulnerable code path in macio_add_one_device()
// When of_device_register() fails, device_initialize() reference is leaked
static int __init macio_leak_init(void)
{
    struct platform_device *pdev;
    int i;
    int ret;

    pr_info("CVE-2022-50474 PoC: Triggering macio memory leak\n");

    // Repeatedly attempt device registration to trigger memory leak
    for (i = 0; i < 1000; i++) {
        // Allocate a platform device (similar to macio device)
        pdev = kzalloc(sizeof(struct platform_device), GFP_KERNEL);
        if (!pdev)
            break;

        // device_initialize() acquires a reference
        device_initialize(&pdev->dev);

        // Simulate of_device_register() failure
        // In vulnerable version, put_device() is NOT called here
        // This causes the reference to leak
        ret = -1; // Force failure
        if (ret) {
            // VULNERABILITY: Missing put_device() call
            // In fixed version, put_device(&pdev->dev) should be called here
            // Without it, the device structure leaks memory
            continue;
        }
    }

    pr_info("CVE-2022-50474 PoC: Memory leak triggered %d times\n", i);
    return 0;
}

static void __exit macio_leak_exit(void)
{
    pr_info("CVE-2022-50474 PoC: Module unloaded\n");
}

module_init(macio_leak_init);
module_exit(macio_leak_exit);
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("CVE-2022-50474 macio memory leak PoC");

// Fixed version should include:
// if (ret) {
//     put_device(&pdev->dev);  // Release the reference
//     return ret;
// }

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2022-50474
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2022-50474
[3] CVE Details https://www.cvedetails.com/cve/CVE-2022-50474/
[4] VulDB https://vuldb.com/cve/CVE-2022-50474
[5] https://git.kernel.org/stable/c/19ded60b40e86b0903c8d5bd0161437ed5107a8b
[6] https://git.kernel.org/stable/c/2ac0a7059b7bcbed35bfffa34a82c9a9e99638ef
[7] https://git.kernel.org/stable/c/35858b87a943917fa30172aa4bf01ce7adbcb42c
[8] https://git.kernel.org/stable/c/3a866ff6fc2232c8e393cdb55ffb8ce947349e03
[9] https://git.kernel.org/stable/c/5ca86eae55a2f006e6c1edd2029b2cacb6979515
[10] https://git.kernel.org/stable/c/76837e7f6b30da72ad59f56291e22804a219e015
[11] https://git.kernel.org/stable/c/aa9054267366ff0a382d403d17728e21951ddbb9
[12] https://git.kernel.org/stable/c/b29a2f1dd33ae9b94821ab2f4d398b9081786748
[13] https://git.kernel.org/stable/c/ca765257feb89dacf604ced9cd233db5f865dee0

Raw JSON Data

JSON

{"cve": {"id": "CVE-2022-50474", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2025-10-04T16:15:43.910", "lastModified": "2026-01-23T16:37:04.517", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacintosh: fix possible memory leak in macio_add_one_device()\n\nAfer commit 1fa5ae857bb1 (\"driver core: get rid of struct device's\nbus_id string array\"), the name of device is allocated dynamically. It\nneeds to be freed when of_device_register() fails. Call put_device() to\ngive up the reference that's taken in device_initialize(), so that it\ncan be freed in kobject_cleanup() when the refcount hits 0.\n\nmacio device is freed in macio_release_dev(), so the kfree() can be\nremoved."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-401"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.30", "versionEndExcluding": "4.9.337", "matchCriteriaId": "103515FB-333E-4369-A6A7-F22A5C600BD2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.10", "versionEndExcluding": "4.14.303", "matchCriteriaId": "1E7450AD-4739-46F0-B81B-C02E7B35A97B"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.15", "versionEndExcluding": "4.19.270", "matchCriteriaId": "AE8904A3-99BE-4E49-9682-1F90A6373F4F"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.20", "versionEndExcluding": "5.4.229", "matchCriteriaId": "A0C0D95E-414A-445E-941B-3EF6A4D3A093"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.5", "versionEndExcluding": "5.10.163", "matchCriteriaId": "D05D31FC-BD74-4F9E-B1D8-9CED62BE6F65"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.86", "matchCriteriaId": "47237296-55D1-4ED4-8075-D00FC85A61EE"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.0.16", "matchCriteriaId": "C720A569-3D93-4D77-95F6-E2B3A3267D9F"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.2", "matchCriteriaId": "77239F4B-6BB2-4B9E-A654-36A52396116C"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/19ded60b40e86b0903c8d5bd0161437ed5107a8b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/2ac0a7059b7bcbed35bfffa34a82c9a9e99638ef", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/35858b87a943917fa30172aa4bf01ce7adbcb42c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/3a866ff6fc2232c8e393cdb55ffb8ce947349e03", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/5ca86eae55a2f006e6c1edd2029b2cacb6979515", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/76837e7f6b30da72ad59f56291e22804a219e015", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/aa9054267366ff0a382d403d17728e21951ddbb9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/b29a2f1dd33ae9b94821ab2f4d398b9081786748", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/ca765257feb89dacf604ced9cd233db5f865dee0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}