Riskcovery

CVE-2022-48735

ALSA: hda: Fix UAF of leds class devs at unbinding

State
Published
Severity
7.8 High
Published
Jun 20, 2024
Updated
Aug 5, 2026
Reserved
Jun 20, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: Fix UAF of leds class devs at unbinding

The LED class devices that are created by HD-audio codec drivers are registered via devm_led_classdev_register() and associated with the HD-audio codec device. Unfortunately, it turned out that the devres release doesn't work for this case; namely, since the codec resource release happens before the devm call chain, it triggers a NULL dereference or a UAF for a stale set_brightness_delay callback.

For fixing the bug, this patch changes the LED class device register and unregister in a manual manner without devres, keeping the instances in hda_gen_spec.

Scores

CVSSScoreVectorSource
3.17.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 15509b6344726de22bdbfff88b65341dd0dd33af to before a7de1002135cf94367748ffc695a29812d7633b5Affected
  • 15509b6344726de22bdbfff88b65341dd0dd33af to before 0e629052f013eeb61494d4df2f1f647c2a9aef47Affected
  • 15509b6344726de22bdbfff88b65341dd0dd33af to before 813e9f3e06d22e29872d4fd51b54992d89cf66c8Affected
  • 15509b6344726de22bdbfff88b65341dd0dd33af to before 549f8ffc7b2f7561bea7f90930b6c5104318e87bAffected
LinuxLinux
  • 5.9Affected
  • before 5.9Not affected
  • 5.10.99 through 5.10.*Not affected
  • 5.15.22 through 5.15.*Not affected
  • 5.16.8 through 5.16.*Not affected
  • 5.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.