Linux Kernel up to 5.15.21/5.16.7 wcd938x chan_info resource consumption

Summaryinfo

A vulnerability categorized as problematic has been discovered in Linux Kernel up to 5.15.21/5.16.7. Impacted is the function chan_info of the component wcd938x. Such manipulation leads to an unknown weakness. This vulnerability is documented as CVE-2022-48716. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.15.21/5.16.7 and classified as problematic. Affected by this issue is the function chan_info of the component wcd938x. Using CWE to declare the problem leads to CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd938x: fix incorrect used of portid Mixer controls have the channel id in mixer->reg, which is not same as port id. port id should be derived from chan_info array. So fix this. Without this, its possible that we could corrupt struct wcd938x_sdw_priv by accessing port_map array out of range with channel id instead of port id.

The advisory is available at git.kernel.org. This vulnerability is handled as CVE-2022-48716. Technical details are known, but there is no available exploit.

Upgrading to version 5.15.22 or 5.16.8 eliminates this vulnerability. Applying the patch aa7152f9f117/9167f2712dc8/c5c1546a654f is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.16.0
• 5.16.1
• 5.16.2
• 5.16.3
• 5.16.4
• 5.16.5
• 5.16.6
• 5.16.7

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion