Refcount Leak Vulnerability in Linux Kernel - ASoC: mediatek Package
Summary
CVE-2022-49161: In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: Fix error handling in mt8183_da7219_max98357_dev_probe The device_node pointer is returned by of_parse_phandle() with refcount increment... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. The ASoC (ALSA System on Chip) subsystem is responsible for audio processing in embedded systems. The specific vulnerability affects the mediatek driver, which is used for audio devices in various Mediatek chipsets. This vulnerability can lead to memory management issues, particularly in error handling paths, potentially affecting system stability and performance.
Vulnerability Detail
In the Linux kernel, specifically within the ASoC mediatek driver, a vulnerability has been identified where the device_node pointer returned by the of_parse_phandle() function is not properly managed in error handling scenarios. The function only calls of_node_put() in the regular execution path, leading to a reference count leak when errors occur. This can result in memory leaks and degraded performance over time, as the system fails to release memory that is no longer needed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patch by updating the package to the fixed version.
Conclusion
The CVE-2022-49161 vulnerability in the Linux kernel's ASoC mediatek driver poses a risk of memory leaks due to improper error handling. It is crucial to update to the patched version to mitigate potential performance issues. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49161 is a vulnerability in the Linux kernel's ASoC mediatek driver that leads to a reference count leak in error handling paths.
This vulnerability can lead to memory leaks, which may degrade system performance and stability over time.
Yes, a patch is available in the Linux package version 5.17.3-1 and later.
You can use Vulert, which monitors open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without needing to install anything.
While there are no specific workarounds, it is advisable to monitor your system for unusual behavior and plan to apply the update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
