ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM
Summary
GSD-2022-1001910: ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM. Affects Kernel versions >= d16046ffa6de040bf580a64d5f4d0aa18258a854, < b6094744e261083d3790c3def770ebf5060d383b. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ASoC (Audio for Linux Sound System) is a subsystem in the Linux kernel that provides audio support for embedded systems. It includes drivers, codecs, and other components necessary for audio processing. The SOF (Sound Open Firmware) is an open-source audio firmware project that supports Intel platforms. It is used in conjunction with ASoC to provide audio capabilities on Intel-based devices.
The vulnerability identified in this report is related to a NULL pointer dereference issue that occurs when the system encounters an ENOMEM (Out of Memory) error. This vulnerability affects the Intel platform and can potentially lead to a system crash or other unexpected behavior.
Vulnerability Detail
The vulnerability arises from a NULL pointer dereference when the system encounters an ENOMEM error. This occurs in the ASoC SOF Intel driver code. When the system is low on memory and an allocation request fails, the driver does not handle the error properly, leading to a NULL pointer dereference. An attacker could potentially exploit this vulnerability to crash the system or execute arbitrary code.
The vulnerability was introduced in version v5.2 of the Linux Kernel by commit d16046ffa6de040bf580a64d5f4d0aa18258a854. It has been fixed in version v5.15.33 by commit b6094744e261083d3790c3def770ebf5060d383b.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
In conclusion, the ASoC SOF Intel driver in the Linux Kernel is vulnerable to a NULL pointer dereference issue when encountering an ENOMEM error. This vulnerability can potentially lead to system crashes or arbitrary code execution. It is crucial to update the Linux Kernel to version v5.15.33 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ASoC (Audio for Linux Sound System) is a subsystem in the Linux kernel that provides audio support for embedded systems. It includes drivers, codecs, and other components necessary for audio processing.
SOF (Sound Open Firmware) is an open-source audio firmware project that supports Intel platforms. It is used in conjunction with ASoC to provide audio capabilities on Intel-based devices.
A NULL pointer dereference occurs when a program attempts to access or manipulate memory using a pointer that is not pointing to a valid memory location (i.e., it has a value of NULL). This can lead to crashes, unexpected behavior, or potential security vulnerabilities.
ENOMEM is an error code that indicates a failure to allocate memory. It stands for 'Out of Memory.' When a system encounters an ENOMEM error, it means that it does not have enough available memory to fulfill a memory allocation request.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software, without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
