CVE-2022-49480 in Linux
Summary
by MITRE • 02/26/2025
In the Linux kernel, the following vulnerability has been resolved:
ASoC: imx-hdmi: Fix refcount leak in imx_hdmi_probe
of_find_device_by_node() takes reference, we should use put_device() to release it. when devm_kzalloc() fails, it doesn't have a put_device(), it will cause refcount leak. Add missing put_device() to fix this.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 02/26/2025
The vulnerability CVE-2022-49480 represents a reference count leak in the Linux kernel's audio subsystem, specifically within the imx-hdmi driver component. This issue occurs in the Advanced SoC (ASoC) framework which manages audio codecs and interfaces for various embedded systems. The flaw manifests in the imx_hdmi_probe function where the kernel fails to properly release device references, leading to resource leakage that can accumulate over time and potentially impact system stability. The vulnerability is classified under CWE-404 as an improper resource management issue, specifically involving reference counting errors in device management operations.
The technical root cause stems from improper handling of device references obtained through the of_find_device_by_node() function which inherently takes a reference to the device object. When the device is successfully located, the code correctly acquires this reference but fails to release it appropriately when subsequent operations encounter failures. The specific scenario occurs when devm_kzalloc() fails during memory allocation, leaving the previously acquired device reference unreleased. This creates a situation where device references remain in memory even though the driver's probe function has failed, causing the reference count to remain elevated and preventing proper device cleanup.
The operational impact of this vulnerability extends beyond simple resource leakage to potentially affect system reliability and performance in embedded audio systems. While the immediate effect might appear minor as a single reference leak, in systems with frequent device probe operations or those running for extended periods, accumulated reference leaks can lead to memory exhaustion and system instability. The vulnerability particularly affects i.MX series processors from NXP that utilize HDMI audio interfaces, making it relevant to automotive infotainment systems, embedded multimedia devices, and other embedded applications where audio subsystem reliability is critical. This issue aligns with ATT&CK technique T1490 which involves resource exhaustion attacks through improper resource management.
Mitigation strategies for this vulnerability involve applying the kernel patch that adds the missing put_device() call to properly release the device reference. System administrators should ensure their embedded systems are updated with the patched kernel version that resolves this specific reference counting issue. The fix requires careful attention to the device reference management pattern, ensuring that every device reference obtained through of_find_device_by_node() is properly released using put_device() before the function returns. Regular kernel updates and security monitoring are essential to prevent similar issues from accumulating in production systems, particularly in environments where embedded devices operate continuously and require stable resource management. The fix demonstrates proper defensive programming practices for device reference handling in kernel space, emphasizing the importance of balanced reference counting operations in preventing resource leaks.