CVE-2022-50427: ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ac97: fix possible memory leak in sndac97devregister()
If deviceregister() fails in sndac97devregister(), it should call putdevice() to give up reference, or the name allocated in devsetname() is leaked.
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access is required to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What is the expected security impact?
The reported impact is limited to availability, with high availability impact. No confidentiality or integrity impact is indicated.
When does the leak occur?
The leak can occur when device_register() fails during snd_ac97_dev_register(). In that failure path, the device reference is not released and the name allocated by dev_set_name() can remain leaked.
What remediation is available?
A patch is available. The supplied references identify stable-kernel commits containing the fix.