ALSA: hda: Fix UAF of leds class devs at unbinding
Published Jun 20, 2024
7.8
HIGHCVSS 3.1
EPSS 0.23%
Description
The LED class devices that are created by HD-audio codec drivers are registered via devm_led_classdev_register() and associated with the HD-audio codec device. Unfortunately, it turned out that the devres release doesn't work for this case; namely, since the codec resource release happens before the devm call chain, it triggers a NULL dereference or a UAF for a stale set_brightness_delay callback.
For fixing the bug, this patch changes the LED class device register and unregister in a manual manner without devres, keeping the instances in hda_gen_spec.
Affected products
-
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version
-
- Version 5.9StatusaffectedConstraints-
- Version 0StatusunaffectedConstraints<5.9
- Version 5.10.99StatusunaffectedConstraints<=5.10.*
- Version 5.15.22StatusunaffectedConstraints<=5.15.*
- Version 5.16.8StatusunaffectedConstraints<=5.16.*
- Version 5.17StatusunaffectedConstraints<=*
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
- ≥ 5.9 · < 5.10.99
- ≥ 5.11 · < 5.15.22
- ≥ 5.16 · < 5.16.8
- 5.17
- 5.17
No data.
Red Hat Enterprise Linux 8
kernel-0:4.18.0-425.3.1.el8
Fixed · RHSA-2022:7683
Red Hat Enterprise Linux 9
kernel-0:5.14.0-162.6.1.el9_1
Fixed · RHSA-2022:8267
Red Hat Enterprise Linux 9
kernel-0:5.14.0-162.6.1.el9_1
Fixed · RHSA-2022:8267
Red Hat Enterprise Linux 6
kernel
Out of support scope
Red Hat Enterprise Linux 7
kernel
Out of support scope
Red Hat Enterprise Linux 7
kernel-rt
Out of support scope
Red Hat Enterprise Linux 8
kernel-rt
Will not fix
Red Hat Enterprise Linux 9
kernel-rt
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | kernel-0:4.18.0-425.3.1.el8 | Fixed | RHSA-2022:7683 |
| Red Hat Enterprise Linux 9 | kernel-0:5.14.0-162.6.1.el9_1 | Fixed | RHSA-2022:8267 |
| Red Hat Enterprise Linux 9 | kernel-0:5.14.0-162.6.1.el9_1 | Fixed | RHSA-2022:8267 |
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | kernel | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Will not fix | n/a |
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (10)
- https://access.redhat.com/security/cve/CVE-2022-48735 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2293324 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-53614 Advisory
- https://git.kernel.org/stable/c/0e629052f013eeb61494d4df2f1f647c2a9aef47 Patch
- https://git.kernel.org/stable/c/549f8ffc7b2f7561bea7f90930b6c5104318e87b Patch
- https://git.kernel.org/stable/c/813e9f3e06d22e29872d4fd51b54992d89cf66c8 Patch
- https://git.kernel.org/stable/c/a7de1002135cf94367748ffc695a29812d7633b5 Patch
- https://lore.kernel.org/linux-cve-announce/2024062001-CVE-2022-48735-32e6@gregkh/T
- https://nvd.nist.gov/vuln/detail/CVE-2022-48735
- https://www.cve.org/CVERecord?id=CVE-2022-48735
Change history (0)
No recorded changes yet.