Memory Leak in soundwire: stream Configuration Error Path
Summary
GSD-2021-1000288: soundwire: stream: fix memory leak in stream config error path. Affects Kernel versions >= 89e590535f32d4bc548bcf266f3b046e50942f6d, < effd2bd62b416f6629e18e3ce077c60de14cfdea. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The soundwire package is a component of the Linux Kernel that provides support for SoundWire bus communication. SoundWire is a low-power, two-wire, multi-stream audio bus that allows for the transmission of audio and control data between devices. The soundwire: stream module within the package is responsible for configuring and managing audio streams. However, a vulnerability has been identified in the stream configuration error path, which can lead to a memory leak.
Vulnerability Detail
The vulnerability in the soundwire: stream module occurs when an error is encountered during the configuration of an audio stream. In this situation, the module fails to release allocated memory, resulting in a memory leak. An attacker could potentially exploit this vulnerability by repeatedly triggering the error path, leading to a depletion of available memory resources. This could result in system instability, denial of service, or even remote code execution if the attacker can control the content of the audio stream configuration. The vulnerability was introduced in version v4.18 of the Linux Kernel and has been fixed in version v5.12.4.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can avoid triggering the error path in the soundwire: stream module by ensuring proper configuration of audio streams. By carefully configuring the streams and avoiding any errors, the memory leak vulnerability can be mitigated. Here is an example of how to configure an audio stream without encountering the error path:
// Example code for configuring an audio stream
stream_config_t config;
// Set the configuration parameters
config.sample_rate = 44100;
config.num_channels = 2;
config.bit_depth = 16;
// Configure the audio stream
int result = configure_stream(&config);
if (result != 0) {
// Handle error
}
Conclusion
In conclusion, the soundwire: stream module in the Linux Kernel is vulnerable to a memory leak issue in the stream configuration error path. This vulnerability can be mitigated by updating the Kernel to version v5.12.4 or later. It is important to promptly apply the fix to ensure the proper release of allocated memory and prevent potential exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The soundwire: stream module is a component of the Linux Kernel that handles the configuration and management of audio streams using the SoundWire bus communication protocol.
The memory leak vulnerability in soundwire: stream occurs when an error is encountered during the configuration of an audio stream. In this situation, the module fails to release allocated memory, leading to a depletion of available memory resources.
The potential consequences of this vulnerability include system instability, denial of service, and remote code execution if the attacker can control the content of the audio stream configuration.
Yes, this vulnerability has been fixed in version v5.12.4 of the Linux Kernel. It was addressed by the commit effd2bd62b416f6629e18e3ce077c60de14cfdea.
To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.12.4 or later, which includes the fix for the memory leak issue in the soundwire: stream module.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
