Refcount Leak Vulnerability in Linux Kernel: ASoC Mediatek Driver
Summary
CVE-2022-49244: In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8192-mt6359: Fix error handling in mt8192_mt6359_dev_probe The device_node pointer is returned by of_parse_phandle() with refcount inc... Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It supports a wide range of hardware architectures and is known for its stability and performance. The ASoC (ALSA System on Chip) framework within the kernel facilitates audio processing on various devices. The vulnerability in question affects the Mediatek mt8192-mt6359 driver, which is responsible for audio functionality in specific Mediatek chipsets.
Vulnerability Detail
The vulnerability arises from improper error handling in the mt8192_mt6359_dev_probe function. Specifically, the device_node pointer returned by of_parse_phandle() has its reference count incremented, but the corresponding of_node_put() is only called in the regular execution path. This oversight leads to a reference count leak during error handling, potentially resulting in memory leaks and degraded system performance over time.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
CVE-2022-49244 is a significant vulnerability in the Linux kernel that affects the ASoC Mediatek driver due to improper error handling. Users are strongly encouraged to update their systems to the patched version to mitigate potential risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49244 is a vulnerability in the Linux kernel related to improper error handling in the ASoC Mediatek driver, leading to a reference count leak.
This vulnerability can lead to memory leaks, which may degrade system performance over time, especially in systems utilizing the affected Mediatek chipsets.
If you are using a version of the Linux kernel prior to 5.17.3-1, particularly on Debian 12 or 13, your system may be vulnerable.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any installation.
While there are no specific workarounds, it is advisable to monitor your system for unusual behavior and apply the update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
