CVE-2022-50115: ASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc3-topology: Prevent double freeing of ipccontroldata via loadbytes
We have sanity checks for byte controls and if any of the fail the locally allocated scontrol->ipccontroldata is freed up, but not set to NULL.
On a rollback path of the error the higher level code will also try to free the scontrol->ipccontroldata which will eventually going to lead to memory corruption as double freeing memory is not a good thing.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50115?
CVE-2022-50115 has a moderate severity rating due to potential memory corruption issues in the Linux kernel.
How do I fix CVE-2022-50115?
To fix CVE-2022-50115, upgrade your Linux kernel to version 5.18.18 or later, or 5.19.2 or later.
What versions of the Linux kernel are affected by CVE-2022-50115?
CVE-2022-50115 affects Linux kernel versions between 5.18 and 5.19.1.
What does CVE-2022-50115 exploit?
CVE-2022-50115 can exploit a flaw in the ASoC: SOF ipc3-topology, allowing for double freeing of ipc_control_data.
Is CVE-2022-50115 publicly known?
Yes, CVE-2022-50115 has been publicly disclosed and documented.