Riskcovery

CVE-2022-49566

crypto: qat - fix memory leak in RSA

State
Published
Severity
5.5 Medium
Published
Feb 26, 2025
Updated
May 11, 2026
Reserved
Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

crypto: qat - fix memory leak in RSA

When an RSA key represented in form 2 (as defined in PKCS #1 V2.1) is used, some components of the private key persist even after the TFM is released. Replace the explicit calls to free the buffers in qat_rsa_exit_tfm() with a call to qat_rsa_clear_ctx() which frees all buffers referenced in the TFM context.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

ProductVersions
LinuxLinux
  • 879f77e9071f029e1c9bd5a75814ecf51370f846 to before a843925e0287eebb4aa808666bf22c664dfe4c53Affected
  • 879f77e9071f029e1c9bd5a75814ecf51370f846 to before 0f967fdc09955221a1951a279481b0bf4d359941Affected
  • 879f77e9071f029e1c9bd5a75814ecf51370f846 to before 80a52e1ee7757b742f96bfb0d58f0c14eb6583d0Affected
LinuxLinux
  • 4.8Affected
  • before 4.8Not affected
  • 5.15.58 through 5.15.*Not affected
  • 5.18.15 through 5.18.*Not affected
  • 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.