Vulnerability in ASoC mxs-saif: Refcount Leak in mxs_saif_probe
Summary
GSD-2022-1002767: ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe. Affects Kernel versions >= 08641c7c74dddfcd726512edfaa3b4cbe42e523e, < d855505851ee8ba666eb204149b49f906130dc17. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ASoC (Audio System on Chip) framework in the Linux Kernel provides support for audio drivers on various embedded systems. One of the components in ASoC is the mxs-saif driver, which is responsible for handling audio input and output on MXS-based platforms. This driver is used in devices that utilize the MXS System-on-Chip architecture. The mxs_saif_probe function is a part of this driver and is responsible for initializing the SAIF (Serial Audio Interface) hardware. However, a vulnerability has been discovered in this function that leads to a refcount leak.
Vulnerability Detail
The vulnerability in the mxs_saif_probe function of the mxs-saif driver allows for a refcount leak. This leak occurs when the function is called multiple times without proper cleanup, resulting in a gradual increase in the reference count of the SAIF hardware. If this vulnerability is exploited, it can lead to resource exhaustion and potential denial-of-service (DoS) attacks. An attacker could repeatedly trigger the mxs_saif_probe function, causing the refcount to grow uncontrollably and eventually exhaust system resources. This vulnerability was introduced in version v3.5 of the Linux Kernel and has been fixed in version v5.18.3.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As this vulnerability has been fixed in the latest version of the Linux Kernel, there is no specific workaround available. It is recommended to update to the fixed version to eliminate the risk of exploitation.
Conclusion
The vulnerability in the mxs-saif driver's mxs_saif_probe function can lead to a refcount leak, potentially resulting in resource exhaustion and denial-of-service (DoS) attacks. It is crucial to update the Linux Kernel to version v5.18.3 or later to fix this vulnerability. By applying the provided fix, the refcount leak will be addressed, ensuring the proper cleanup of the SAIF hardware. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ASoC (Audio System on Chip) is a framework in the Linux Kernel that provides support for audio drivers on embedded systems. It enables the integration of audio functionality into various devices, such as smartphones, tablets, and IoT devices.
mxs-saif is a driver component in the ASoC framework that handles audio input and output on MXS-based platforms. It is responsible for initializing the SAIF (Serial Audio Interface) hardware.
A refcount leak occurs when the reference count of a resource is not properly decremented after it is no longer needed. This can lead to resource exhaustion and potential denial-of-service (DoS) attacks.
If this vulnerability is exploited, it can lead to resource exhaustion and potential denial-of-service (DoS) attacks. An attacker could repeatedly trigger the mxs_saif_probe function, causing the refcount to grow uncontrollably and eventually exhaust system resources.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
