Refcount Leak Vulnerability in Linux Kernel Audio Graph Card - CVE-2022-50113
Summary
CVE-2022-50113: In the Linux kernel, the following vulnerability has been resolved: ASoc: audio-graph-card2: Fix refcount leak bug in __graph_get_type() We should call of_node_put() for the reference before its replacement as it returne... Affects linux versions < 6.0.2-1. Fixed in 6.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. It supports a wide range of functionalities, including device drivers, file systems, and network protocols. The audio-graph-card module is responsible for managing audio devices in a graph-based manner, allowing for complex audio routing. This vulnerability specifically affects the audio-graph-card2 implementation, which is crucial for audio processing in various applications.
Vulnerability Detail
CVE-2022-50113 is a vulnerability in the Linux kernel's audio-graph-card2 module, where a reference count leak occurs in the __graph_get_type() function. This leak arises because the function fails to properly release a reference to a node before replacing it with a new one, leading to potential memory management issues. If exploited, this could result in resource exhaustion or instability in the audio subsystem, affecting the overall system performance and reliability.
How To Fix
Minimum fixed version
6.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch as soon as it becomes available.
Conclusion
CVE-2022-50113 is a significant vulnerability in the Linux kernel's audio-graph-card2 module, which can lead to memory management issues if not addressed. Users are advised to update their systems to the patched version to ensure stability and security. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2022-50113 is a vulnerability in the Linux kernel's audio-graph-card2 module that involves a reference count leak, potentially leading to resource management issues.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to install any software.
If exploited, this vulnerability could lead to memory management issues, causing resource exhaustion or instability in the audio subsystem, which may affect system performance.
Yes, a patch is available in the form of the Linux kernel version 6.0.2-1. Users should update their kernel to this version to mitigate the vulnerability.
You can update your Linux kernel by running the command: sudo apt-get update && sudo apt-get install linux=6.0.2-1 in your terminal.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
