CVE-2022-48669

What it actually does

The vulnerability is a memory leak in papr_get_attr() where a krealloc() failure on buf does not free the original allocation, allowing memory to be lost on each failure path.

Why it matters to the business

Repeated triggering can gradually exhaust available memory on affected systems, leading to degraded performance or denial-of-service conditions; the low EPSS and lack of KEV status indicate limited immediate urgency but the issue remains in long-running processes.

How an attack unfolds

An attacker with local access or the ability to invoke papr_get_attr() repeatedly induces krealloc() failures (for example via memory pressure) so that the original buffer is never freed, accumulating leaked memory until the system becomes unstable.

How to fix it

Upgrade faforever/fa (GIT) to commit 6880971bd3d73d942384aff62d53058c206ce644 which contains the fix that properly frees the original buf on krealloc() failure.

How to confirm the fix worked

Confirm the patched commit is present in the running kernel source or binary; monitor for continued allocation growth in the affected code path after the update.

Typical attack path

1. Obtain ability to invoke papr_get_attr() on a powerpc/pseries system
2. Induce memory pressure sufficient to cause krealloc() to fail
3. Repeat the invocation to accumulate unfreed buffers
4. Continue until system memory is exhausted and services degrade or crash

How to detect it

Inspect kernel or system logs for repeated allocation failures around papr_get_attr(); correlate with rising memory usage that does not correspond to normal workload growth.

What your security team should do

• Apply the referenced commit to all affected powerpc/pseries kernels as soon as practical
• Review memory-usage monitoring for unexplained growth in long-running processes
• Prioritize systems that run the papr_get_attr() code path under memory-constrained conditions