ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
Summary
GSD-2022-1002363: ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe. Affects Kernel versions >= 531f67e41dcde1e358cf821d056241a66355cf03, < b0c56a0071116a37c24df998166c22a7e4684626. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ASoC (Audio System on Chip) framework in the Linux Kernel provides support for audio devices on embedded systems. The Atmel at91sam9g20ek_audio_probe driver is responsible for initializing the audio subsystem on the Atmel AT91SAM9G20EK development board. This vulnerability affects the Linux Kernel package.
Vulnerability Detail
The at91sam9g20ek_audio_probe driver in the ASoC framework for the Atmel AT91SAM9G20EK development board does not properly release a reference to a device tree node, leading to a memory leak. An attacker with local access to the system could potentially exploit this vulnerability to exhaust system memory resources, resulting in a denial of service condition. The vulnerability was introduced in Linux Kernel version v3.8 and is fixed in version v4.19.238.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability.
Conclusion
The ASoC atmel: Add missing of_node_put() vulnerability in the Linux Kernel package affects the at91sam9g20ek_audio_probe driver for the Atmel AT91SAM9G20EK development board. It can potentially be exploited by an attacker with local access to the system to exhaust system memory resources, resulting in a denial of service condition. To fix this vulnerability, update the Linux Kernel package to version v4.19.238 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could potentially be exploited by an attacker with local access to the system to exhaust system memory resources, leading to a denial of service condition.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and Vulert will analyze it for any open-source vulnerabilities, including this one.
Yes, a patch for this vulnerability is available in Linux Kernel version v4.19.238. It is recommended to update to this version or later to fix the vulnerability.
No, this vulnerability requires local access to the system in order to be exploited.
There are no known instances of this vulnerability being exploited in the wild at this time.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
