Refcount Leak in ASoC Samsung Aries Audio Probe
Summary
GSD-2022-1003608: ASoC: samsung: Fix refcount leak in aries_audio_probe. Affects Kernel versions >= 7a3a7671fa6c7e90aff5f4242add2a40587b85ef, < cacea459f95be22b3750f3b25b7a1c5897a68206. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ASoC (Audio System on Chip) framework in the Linux Kernel provides support for audio drivers on various platforms. The Samsung Aries Audio Probe is a component of the ASoC framework specifically designed for Samsung devices. It is responsible for initializing and configuring the audio hardware on these devices. However, a vulnerability has been discovered in the ASoC Samsung Aries Audio Probe that can lead to a refcount leak.
Vulnerability Detail
The refcount leak vulnerability in the ASoC Samsung Aries Audio Probe occurs when the probe function does not properly release the reference count of certain resources. This can result in a resource leak, leading to potential memory corruption or exhaustion. An attacker with local access to the affected device may be able to exploit this vulnerability to escalate privileges or cause a denial-of-service condition. The vulnerability was introduced in Linux Kernel version 5.9 and has been fixed in version 5.10.121.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the patch provided in the updated Linux Kernel to mitigate the risk of exploitation.
Conclusion
The refcount leak vulnerability in the ASoC Samsung Aries Audio Probe can pose a significant risk to the security and stability of affected devices. It is crucial to update the Linux Kernel to version 5.10.121 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The vulnerability can potentially be exploited by an attacker with local access to the affected device to escalate privileges or cause a denial-of-service condition.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will provide real-time alerts for open-source vulnerabilities, including this one.
At the time of this report, there is no known public exploit for this vulnerability. However, it is still crucial to apply the recommended patch to ensure the security of your system.
No, this vulnerability requires local access to the affected device to be exploited.
Unfortunately, there are no known mitigations available for this vulnerability other than applying the patch provided in the updated Linux Kernel. It is recommended to prioritize the kernel update as soon as possible.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
