ALSA: hda: Fix UAF of leds class devs at unbinding
Summary
GSD-2022-1000572: ALSA: hda: Fix UAF of leds class devs at unbinding. Affects Kernel versions < 0e629052f013eeb61494d4df2f1f647c2a9aef47. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ALSA (Advanced Linux Sound Architecture) is a software framework and part of the Linux kernel that provides an API for sound card device drivers. It enables sound card manufacturers to create drivers that are compatible with various Linux distributions. The ALSA HDA (High Definition Audio) driver is responsible for managing audio devices that use the Intel High Definition Audio specification. This vulnerability affects the ALSA HDA driver in the Linux Kernel.
Vulnerability Detail
The vulnerability identified as GSD-2022-1000572 in the Linux Kernel ALSA HDA driver involves a use-after-free (UAF) issue related to the handling of leds class devices during the unbinding process. This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition. The UAF occurs when the driver fails to properly release the resources associated with leds class devices, leading to a situation where an attacker can manipulate the freed memory to achieve their malicious objectives. The impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
The vulnerability has been fixed in the Linux Kernel version v5.15.22 by commit 0e629052f013eeb61494d4df2f1f647c2a9aef47. To fix the vulnerability, users are advised to update their Linux Kernel to version v5.15.22 or later. This can be done by downloading the updated kernel source code from the official Linux Kernel repository (https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/) and compiling it according to the provided instructions.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the affected functionality by unloading the ALSA HDA driver module. This can be achieved by executing the following command as root or with sudo privileges:
modprobe -r snd_hda_intel
However, it is recommended to apply the official fix by updating the Linux Kernel to the patched version.
Conclusion
The ALSA HDA driver in the Linux Kernel is vulnerable to a use-after-free issue related to the handling of leds class devices during the unbinding process. This vulnerability can potentially be exploited by attackers to execute arbitrary code or cause a denial-of-service condition. It is recommended to update the Linux Kernel to version v5.15.22 or later to fix this vulnerability. Users can also check the vulnerability status of their application using Vulert Playground (https://vulert.com/scanner) without requiring access to the code or installation.
See every vulnerability recorded for Kernel →
FAQ
ALSA HDA (Advanced Linux Sound Architecture High Definition Audio) is a driver in the Linux Kernel responsible for managing audio devices that use the Intel High Definition Audio specification.
A use-after-free vulnerability is a type of memory corruption issue where a program or driver continues to reference memory after it has been freed. This can lead to various security vulnerabilities, including arbitrary code execution or denial-of-service conditions.
This vulnerability can be exploited by an attacker to execute arbitrary code or cause a denial-of-service condition. By manipulating the freed memory associated with leds class devices, an attacker can achieve their malicious objectives.
The impact and attack plausibility of this vulnerability have not been proven yet. However, it is important to apply the fix as a precautionary measure to ensure the security and stability of the system.
To fix this vulnerability, users are advised to update their Linux Kernel to version v5.15.22 or later. This can be done by downloading the updated kernel source code from the official Linux Kernel repository and compiling it according to the provided instructions.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.