Refcount Leak in imx-hdmi Driver of Linux Kernel - CVE-2022-49480
Summary
CVE-2022-49480: In the Linux kernel, the following vulnerability has been resolved: ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe of_find_device_by_node() takes reference, we should use put_device() to release it. Affects linux versions < 5.18.5-1. Fixed in 5.18.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system operations. The imx-hdmi driver is responsible for handling HDMI interfaces on i.MX processors, enabling audio and video output. This driver is crucial for multimedia applications, and any vulnerabilities can lead to system instability or security risks.
Vulnerability Detail
CVE-2022-49480 is a vulnerability in the imx-hdmi driver of the Linux kernel, where a reference count leak occurs due to improper handling of device references. Specifically, the function of_find_device_by_node() takes a reference to a device, but if the subsequent devm_kzalloc() fails, the reference is not released, leading to a memory leak. This can result in increased memory usage and potential denial of service if the system runs out of memory.
How To Fix
Minimum fixed version
5.18.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2022-49480 is a significant vulnerability in the imx-hdmi driver of the Linux kernel that can lead to memory leaks and system instability. Users are advised to update their systems to the patched version to mitigate any risks associated with this vulnerability.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49480 is a vulnerability in the imx-hdmi driver of the Linux kernel that causes a reference count leak.
This vulnerability can lead to increased memory usage and potentially cause a denial of service if the system runs out of memory.
The vulnerability affects Linux versions prior to 5.18.5-1 in Debian 12 and 13.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Yes, a patch is available in version 5.18.5-1 and later. It is recommended to update your Linux package to this version.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
