Vulnerability in ASoC: mxs-saif
Summary
GSD-2022-1004012: ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe. Affects Kernel versions >= 08641c7c74dddfcd726512edfaa3b4cbe42e523e, < d42601e93fce7802bb8d70dd59b60cfeefa20469. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ASoC (Audio System on Chip) framework in the Linux Kernel provides support for audio devices integrated into system-on-chip (SoC) platforms. One of the components in the ASoC framework is mxs-saif, which is responsible for handling audio data on the MXS (i.MX23/i.MX28) SoC family. The mxs-saif driver allows audio input and output through the SAIF (Serial Audio Interface) peripheral. However, a vulnerability has been discovered in the mxs-saif driver that can lead to a reference count leak during the probe process.
Vulnerability Detail
The vulnerability in mxs-saif driver arises from a refcount leak in the mxs_saif_probe function. When the mxs_saif_probe function is called, it increments the reference count of the device. However, if an error occurs during the probe process, the reference count is not properly decremented, leading to a refcount leak. This refcount leak can result in resource exhaustion and potential denial-of-service conditions. The vulnerability was introduced in Linux Kernel version v3.5 by commit 08641c7c74dddfcd726512edfaa3b4cbe42e523e and has been fixed in version v4.14.283 by commit d42601e93fce7802bb8d70dd59b60cfeefa20469.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The vulnerability in the mxs-saif driver can lead to resource exhaustion and potential denial-of-service conditions. It is recommended to update the Linux Kernel to version v4.14.283 or later to fix this vulnerability. Stay updated with the official Linux Kernel security advisories for any future patches or updates related to the mxs-saif driver. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ASoC stands for Audio System on Chip. It is a framework in the Linux Kernel that provides support for audio devices integrated into system-on-chip (SoC) platforms.
mxs-saif is a component in the ASoC framework responsible for handling audio data on the MXS (i.MX23/i.MX28) SoC family. It allows audio input and output through the SAIF (Serial Audio Interface) peripheral.
A refcount leak occurs when the reference count of a resource is not properly decremented, leading to a leak of resources. In this vulnerability, a refcount leak happens during the mxs_saif_probe function, potentially resulting in resource exhaustion and denial-of-service conditions.
The vulnerability can lead to resource exhaustion and potential denial-of-service conditions. An attacker may be able to exploit this vulnerability to exhaust system resources, causing the affected system to become unresponsive or crash.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software, without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
