Refcount Leak Vulnerability in Linux Kernel - ASoC: mediatek: mt8195
Summary
CVE-2022-49240: In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8195: Fix error handling in mt8195_mt6359_rt1019_rt5682_dev_probe The device_node pointer is returned by of_parse_phandle() with refco... Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system operations. It supports a wide range of hardware architectures and is known for its stability and performance. The ASoC (ALSA System on Chip) framework within the kernel facilitates audio processing on various devices. The vulnerability in question affects the mt8195 audio driver, specifically in the handling of device node references, which can lead to resource leaks.
Vulnerability Detail
The vulnerability arises from improper error handling in the mt8195_mt6359_rt1019_rt5682_dev_probe function. When the function encounters an error, it fails to release a device_node pointer returned by of_parse_phandle(), leading to a reference count leak. This leak can result in increased memory usage over time, potentially causing system instability or crashes, especially in long-running processes or systems with limited resources.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-49240 is a significant vulnerability in the Linux kernel that can lead to resource leaks and system instability. Users are advised to update their kernel to the patched version 5.17.3-1 to mitigate this issue. Regular monitoring and timely updates are essential to maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49240 is a vulnerability in the Linux kernel related to improper error handling in the mt8195 audio driver, leading to a reference count leak.
This vulnerability can lead to increased memory usage and potential system instability, especially in systems that run for extended periods.
If you are using a version of the Linux kernel prior to 5.17.3-1, your system may be vulnerable. You can check your kernel version using the command 'uname -r'.
You can use tools like Vulert, which monitors your software for open-source vulnerabilities using a manifest file like package-lock.json.
Detailed information about CVE-2022-49240 can be found in the official CVE database or through security advisories from your Linux distribution.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
