Vulnerability in ASoC Codecs wc938x
Summary
GSD-2022-1001877: ASoC: codecs: wc938x: fix accessing array out of bounds for enum type. Affects Kernel versions >= e8ba1e05bdc016700c85fad559a812c2e795442f, < adafea71b49ec4dbc44e0b84ec6eb602004a7a08. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ASoC (Audio System on Chip) codecs wc938x is a component of the Linux Kernel. It provides audio functionality for devices using the wc938x codec. This vulnerability affects versions v5.14 to v5.15.32 of the Linux Kernel. The wc938x codec driver in these versions has a flaw that allows accessing an array out of bounds for an enum type.
Vulnerability Detail
The vulnerability in the ASoC codecs wc938x arises from accessing an array out of bounds for an enum type. This can lead to memory corruption or other undefined behavior, potentially allowing an attacker to execute arbitrary code or cause a denial of service. The vulnerability was introduced in version v5.14 of the Linux Kernel and was fixed in version v5.15.33.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the fix by updating the Linux Kernel.
Conclusion
The ASoC codecs wc938x in the Linux Kernel versions v5.14 to v5.15.32 are vulnerable to an array out of bounds access for an enum type. This can lead to memory corruption or other undefined behavior. To mitigate this vulnerability, it is recommended to update the Linux Kernel to version v5.15.33 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The impact of this vulnerability can vary depending on the specific use case and system configuration. In some scenarios, it may allow an attacker to execute arbitrary code or cause a denial of service.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is always recommended to apply security patches promptly to mitigate any potential risks.
No, updating the Linux Kernel to the fixed version is the recommended approach to mitigate the risk posed by this vulnerability. Applying security patches is crucial to maintain the integrity and security of the system.
You can find more information about this vulnerability in the official Linux Kernel repository. The commit adafea71b49ec4dbc44e0b84ec6eb602004a7a08 contains the fix for this vulnerability and provides additional details.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
