ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
Summary
GSD-2022-1003800: ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe. Affects Kernel versions >= 8625c1dbd87631572f8e2c05bc67736b73d6f02f, < c71494f5f2b444adfd992a7359a0d2a791642b39. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ASoC (Audio System on Chip) framework in the Linux Kernel is responsible for managing audio devices on embedded systems. The mediatek driver is specifically designed for MediaTek SoCs (System on Chips) and provides support for audio codecs. The mt2701_wm8960_machine_probe function is a part of this driver and is responsible for initializing the WM8960 audio codec on the MediaTek MT2701 platform.
Vulnerability Detail
The mt2701_wm8960_machine_probe function in the mediatek ASoC driver in the Linux Kernel prior to version 5.4.198 does not properly handle a reference count, leading to a use-after-free vulnerability. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service (DoS) condition. The vulnerability was introduced in version 4.12 of the Linux Kernel and was fixed in version 5.4.198 by commit c71494f5f2b444adfd992a7359a0d2a791642b39.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the Linux Kernel to the latest version.
Conclusion
The ASoC mediatek driver in the Linux Kernel prior to version 5.4.198 is vulnerable to a use-after-free vulnerability in the mt2701_wm8960_machine_probe function. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial of service (DoS) condition. It is recommended to update the Linux Kernel to version 5.4.198 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ASoC (Audio System on Chip) is a framework in the Linux Kernel for managing audio devices on embedded systems.
The mediatek driver is a specific driver in the ASoC framework designed for MediaTek SoCs (System on Chips) and provides support for audio codecs.
The mt2701_wm8960_machine_probe function is a part of the mediatek driver and is responsible for initializing the WM8960 audio codec on the MediaTek MT2701 platform.
A use-after-free vulnerability occurs when a program continues to use a memory reference after it has been freed, which can lead to arbitrary code execution or a denial of service (DoS) condition.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
