CVE-2022-49661 is a vulnerability identified in the Linux kernel's gs_usb driver, which is responsible for interfacing with USB CAN (Controller Area Network) adapters. The issue stems from improper memory management in the driver's open and close routines. Specifically, the driver allocates USB request blocks (URBs) using usb_alloc_coherent() for receiving data (RX), but it incorrectly attempts to free these URBs using usb_kill_anchored_urbs(), which does not actually release the allocated DMA memory. This results in a memory leak where DMA memory remains allocated even after the driver is closed. The vulnerability was addressed by adapting a fix from a similar issue in the esd_usb2 driver, explicitly freeing the RX URBs and their DMA memory with usb_free_coherent() during the gs_can_close() function rather than relying on the disconnect function. This fix ensures that all allocated resources are properly released, preventing the memory leak. The vulnerability affects specific Linux kernel versions identified by commit hashes, and no known exploits are currently reported in the wild. The issue primarily impacts systems using the gs_usb driver for USB CAN adapters, which are commonly used in automotive, industrial, and embedded systems for CAN bus communication over USB. Since the vulnerability involves a memory leak, it could lead to gradual resource exhaustion on affected systems, potentially causing degraded performance or system instability over time if the driver is frequently opened and closed without rebooting or manual intervention.

For European organizations, the impact of CVE-2022-49661 depends largely on their use of Linux systems with USB CAN adapters relying on the gs_usb driver. Industries such as automotive manufacturing, industrial automation, and embedded systems development in Europe often use CAN bus technology for vehicle diagnostics, control systems, and industrial equipment monitoring. A memory leak in the driver could lead to resource exhaustion on critical Linux-based systems, causing performance degradation or crashes that disrupt operations. While this vulnerability does not directly allow remote code execution or privilege escalation, the resulting instability could impact availability and reliability of systems, potentially affecting production lines, vehicle testing environments, or embedded device functionality. European organizations with stringent uptime requirements or those operating in safety-critical sectors may face operational risks if the vulnerability is not addressed. However, since exploitation requires the driver to be actively used and the leak accumulates over time, the immediate risk is moderate. The absence of known exploits in the wild further reduces the urgency but does not eliminate the need for remediation, especially in environments where USB CAN adapters are integral to operations.

To mitigate the risk posed by CVE-2022-49661, European organizations should: 1) Identify Linux systems using the gs_usb driver for USB CAN adapters and verify kernel versions against the affected commits. 2) Apply the official Linux kernel patches that fix the memory leak by properly freeing URBs and DMA memory in the gs_usb driver. If using distribution kernels, update to the latest kernel versions or backported security patches provided by the vendor. 3) Implement monitoring of system memory usage and driver behavior on affected systems to detect abnormal memory consumption patterns that may indicate the leak is active. 4) Where possible, limit the frequency of opening and closing the gs_usb driver to reduce the rate of memory leakage until patches are applied. 5) For embedded or industrial devices that cannot be easily updated, consider isolating affected systems from critical networks and scheduling regular reboots to clear leaked memory. 6) Engage with hardware and software vendors to confirm that their USB CAN adapter drivers incorporate the fix and to receive guidance on secure deployment. 7) Maintain an inventory of USB CAN devices and drivers in use to facilitate rapid response to future vulnerabilities.