Kernel Oopses in Intel ASoC due to Card Registration Failure in Linux Package
Summary
CVE-2022-49617: In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sof_sdw: handle errors on card registration If the card registration fails, typically because of deferred probes, the device properties add... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the Debian operating system, providing essential services for hardware management and system operations. It supports a wide range of hardware architectures and is known for its stability and performance. The kernel's ASoC (ALSA System on Chip) subsystem is responsible for managing audio devices, including Intel's SoundWire (sof_sdw) technology. This vulnerability arises when the card registration process fails, leading to potential system instability.
Vulnerability Detail
In the Linux kernel, specifically within the ASoC subsystem for Intel's SoundWire, a vulnerability has been identified where errors during card registration are not properly handled. When the registration fails, typically due to deferred probes, device properties for headset codecs remain in place, which can cause kernel oopses during driver bind/unbind tests. This oversight can lead to system crashes and instability, affecting the overall reliability of the audio subsystem.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. It is recommended to apply the patch as soon as it becomes available to mitigate the risks associated with this issue.
Conclusion
CVE-2022-49617 represents a significant vulnerability in the Linux kernel's ASoC subsystem, particularly affecting Intel's SoundWire technology. Proper handling of card registration failures is crucial to maintaining system stability. Users are encouraged to update to the patched version to mitigate risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49617 is a vulnerability in the Linux kernel's ASoC subsystem that can lead to kernel oopses due to improper handling of card registration failures.
The vulnerability affects Linux packages in Debian 11, 12, and 13, particularly before the fixed version 5.18.14-1.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected without any signup.
If exploited, this vulnerability can lead to system crashes and instability, particularly during audio driver operations, affecting the user experience.
Currently, there are no specific workarounds available. It is advisable to apply the patch as soon as it is released.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
