CVE-2022-50868

What it actually does

Missing pci_dev_put() after early break from for_each_pci_dev() loop in AMD hwrng driver causes PCI device reference count leak on both normal and error paths.

Why it matters to the business

Gradual resource exhaustion possible on systems using affected AMD hardware RNG; low EPSS and no KEV status indicate limited operational urgency despite 305 days since publication.

How an attack unfolds

An attacker with local access or ability to influence PCI device enumeration triggers the AMD RNG code path that exits the pci_get_device loop without releasing the reference, resulting in a leak that may be chained with other memory corruption primitives.

How to fix it

Upgrade thinkgem/jeesite to commit eeb530562393fb481690a8ef0cb3bb15503f29f0 and thinkgem/jeesite5 to commit 3585737d21fe490ff6948d913fcbd8d99c41fc08; verify the added pci_dev_put() calls are present in both success and error exit paths.

How to confirm the fix worked

Inspect the patched driver source for pci_dev_put() on loop exit, run kernel build tests exercising AMD RNG initialization, and confirm no reference count warnings appear in dmesg under PCI enumeration stress.

Typical attack path

1. Gain ability to load or exercise the AMD hwrng driver
2. Force early termination of for_each_pci_dev() enumeration via error or device state manipulation
3. Accumulate unreleased PCI device references over repeated invocations
4. Combine with other kernel memory primitives to achieve corruption or denial of service

How to detect it

Review kernel logs for unbalanced PCI device reference warnings, monitor /proc/meminfo and slab usage for unexpected growth tied to pci_dev objects, and search dmesg or audit logs for repeated AMD hwrng initialization attempts.

What your security team should do

• Apply the listed commit fixes to all instances of the affected GIT repositories immediately
• Prioritize systems exposing AMD RNG hardware or running custom kernel modules derived from the driver
• Add kernel memory and PCI reference count monitoring to existing observability