Kernel Vulnerability in Linux Packages: Q6afe-clocks Driver Reprobing Issue
Summary
CVE-2021-47037: In the Linux kernel, the following vulnerability has been resolved: ASoC: q6afe-clocks: fix reprobing of the driver Q6afe-clocks driver can get reprobed. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the system, including device drivers, system calls, and process management. The Q6afe-clocks driver is responsible for managing clock signals for audio processing in certain hardware configurations. This driver is crucial for ensuring that audio data is processed correctly and efficiently. However, it is vulnerable to a reprobing issue that can occur after firmware crashes, leading to system instability.
Vulnerability Detail
The vulnerability arises from the Q6afe-clocks driver being able to get reprobed after the APR services are restarted following a firmware crash. During the first probe call, the hardware initialization data gets cleared, which can lead to a system crash (oops). This issue can cause significant disruptions in audio processing and overall system performance, particularly in environments relying on real-time audio processing.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, avoiding the use of the Q6afe-clocks driver until the package is updated may help mitigate the risk of system crashes.
Conclusion
The vulnerability in the Q6afe-clocks driver of the Linux kernel poses a significant risk of system crashes due to improper handling of hardware initialization during reprobing. Updating to the latest package version is essential to mitigate this risk. Users are encouraged to monitor their systems for vulnerabilities using tools like Vulert.
See every vulnerability recorded for linux →
FAQ
The Q6afe-clocks driver manages clock signals for audio processing in certain hardware configurations within the Linux kernel.
If the driver is reprobed after a firmware crash, it can lead to a system crash due to cleared hardware initialization data.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
Yes, a patch is available in the Linux package version 5.14.6-1 and later.
If you cannot update immediately, consider avoiding the use of the Q6afe-clocks driver until the update can be applied.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
