Vulnerability in Kernel: ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
Summary
GSD-2022-1003645: ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe. Affects Kernel versions >= 8625c1dbd87631572f8e2c05bc67736b73d6f02f, < f279c49f17ce10866087ea6c0c57382158974b63. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel is a critical component of the Linux operating system that manages communication between hardware and software. It provides essential functionalities and services to ensure the proper functioning of the system. ASoC (Audio System on Chip) is a subsystem within the Kernel that handles audio-related functionalities. The mediatek driver in the ASoC subsystem is responsible for supporting MediaTek audio devices. One of the specific drivers, mt2701_wm8960_machine_probe, is used for the MediaTek MT2701 platform with the WM8960 audio codec.
Vulnerability Detail
The vulnerability identified in the mt2701_wm8960_machine_probe driver is a missing of_node_put issue. This vulnerability was introduced in version v4.12 of the Linux Kernel by commit 8625c1dbd87631572f8e2c05bc67736b73d6f02f and affects all versions until v5.10.121. The vulnerability occurs when the driver fails to release a reference to a device tree node, potentially leading to a resource leak. Although the impact and attack plausibility have not been proven, this vulnerability could potentially be exploited by an attacker to cause resource exhaustion or other unexpected behavior.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the Kernel to the fixed version.
Conclusion
The vulnerability in the mt2701_wm8960_machine_probe driver of the Kernel can be addressed by updating to version v5.10.121 or later. It is crucial to keep the Kernel up to date to ensure the security and stability of the system. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability is not yet proven, but it could potentially lead to resource leaks, resource exhaustion, or other unexpected behavior.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. It analyzes your manifest file (e.g., package-lock.json) and provides real-time alerts for open-source vulnerabilities.
There is no known exploit for this vulnerability at the moment. However, it is always recommended to apply security patches and updates to mitigate potential risks.
There may be other vulnerabilities in the Kernel or its components. It is important to regularly update the Kernel and monitor security advisories to stay protected against potential threats.
You can find more information about this vulnerability in the GSD-2022-1003645 entry of the GSD Database maintained by the Cloud Security Alliance. The link to the specific entry is provided in the vulnerability details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
