Memory Leak Vulnerability in Linux Kernel: ASoC Rockchip I2S TDM Resume Issue
Summary
CVE-2022-49245: In the Linux kernel, the following vulnerability has been resolved: ASoC: rockchip: Fix PM usage reference of rockchip_i2s_tdm_resume pm_runtime_get_sync will increment pm usage counter even it failed. Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management, process scheduling, and system calls. It is widely used in various distributions, including Debian. The kernel's ASoC (ALSA System on Chip) subsystem is responsible for managing audio devices. The vulnerability in question affects the Rockchip I2S TDM (Time Division Multiplexing) driver, which is used for audio data transmission. This vulnerability can lead to resource leaks, potentially affecting system stability and performance.
Vulnerability Detail
The vulnerability arises from improper handling of the power management reference count in the Rockchip I2S TDM resume function. Specifically, the function pm_runtime_get_sync was incorrectly used, which increments the power management usage counter even when the operation fails. This oversight can lead to a reference leak, where the usage counter is not decremented appropriately, resulting in increased resource consumption and potential system instability. The issue has been resolved in version 5.17.3-1 of the Linux package.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as it is available.
Conclusion
CVE-2022-49245 is a significant vulnerability in the Linux kernel that can lead to memory leaks and system instability. Users are strongly advised to update to the patched version 5.17.3-1 to mitigate the risks associated with this vulnerability. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49245 is a vulnerability in the Linux kernel related to improper power management handling in the Rockchip I2S TDM driver.
This vulnerability can lead to memory leaks, which may cause system instability and degraded performance over time.
If you are using a version of the Linux kernel prior to 5.17.3-1, your system may be affected. You can check your kernel version using the command 'uname -r'.
You can use tools like Vulert, which monitors and alerts for open-source vulnerabilities in your software using a manifest file like package-lock.json.
Detailed information about CVE-2022-49245 can be found in the official CVE database and through security advisories related to the Linux kernel.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
