Critical NULL Dereference Vulnerability in Linux Kernel - CVE-2022-50049
Summary
CVE-2022-50049: In the Linux kernel, the following vulnerability has been resolved: ASoC: DPCM: Don't pick up BE without substream When DPCM tries to add valid BE connections at dpcm_add_paths(), it doesn't check whether the picked BE a... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for all other parts of the system. It manages hardware resources, facilitates communication between software and hardware, and ensures system stability. The kernel is crucial for system performance and security, making it a prime target for vulnerabilities. CVE-2022-50049 highlights a specific issue within the ASoC (ALSA System on Chip) framework, which is responsible for handling audio devices in the Linux kernel.
Vulnerability Detail
CVE-2022-50049 is a vulnerability in the Linux kernel's ASoC subsystem, specifically related to the DPCM (Dynamic PCM) framework. The issue arises when DPCM attempts to add valid backend (BE) connections without verifying if the selected BE supports the intended stream direction. This oversight can lead to a NULL dereference when the code assumes the existence of a corresponding BE substream, potentially causing system crashes or instability. The vulnerability is particularly concerning in scenarios involving asymmetric BE streams, where the mismatch can lead to unpredictable behavior.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using asymmetric BE streams until the kernel is updated. This may involve reconfiguring audio settings or using alternative audio devices that do not trigger the vulnerability.
Conclusion
CVE-2022-50049 is a significant vulnerability in the Linux kernel that can lead to system instability due to improper handling of audio backend connections. Users are advised to update their systems promptly to the patched version to ensure security and stability.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50049 is a vulnerability in the Linux kernel's ASoC subsystem that can lead to a NULL dereference due to improper handling of backend connections.
This vulnerability can cause system crashes or instability when the kernel encounters an asymmetric backend stream, leading to unpredictable behavior.
If you are affected, it is crucial to update your Linux kernel to version 6.0.2-1 or later to mitigate the vulnerability.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
Vulert is a tool that monitors open-source vulnerabilities in your software using just a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
