Linux Kernel up to 5.18.2 sof_get_control_data out-of-bounds

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.18.2. It has been declared as problematic. Affected by this issue is the function sof_get_control_data. Executing a manipulation can lead to out-of-bounds. This vulnerability is registered as CVE-2022-49518. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Linux Kernel up to 5.18.2. This vulnerability affects the function sof_get_control_data. The manipulation with an unknown input leads to a out-of-bounds vulnerability. The CWE definition for the vulnerability is CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. As an impact it is known to affect confidentiality. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-topology: Correct get_control_data for non bytes payload It is possible to craft a topology where sof_get_control_data() would do out of bounds access because it expects that it is only called when the payload is bytes type. Confusingly it also handles other types of controls, but the payload parsing implementation is only valid for bytes. Fix the code to count the non bytes controls and instead of storing a pointer to sof_abi_hdr in sof_widget_data (which is only valid for bytes), store the pointer to the data itself and add a new member to save the size of the data. In case of non bytes controls we store the pointer to the chanv itself, which is just an array of values at the end. In case of bytes control, drop the wrong cdata->data (wdata[i].pdata) check against NULL since it is incorrect and invalid in this context. The data is pointing to the end of cdata struct, so it should never be null.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2022-49518 since 02/26/2025. There are known technical details, but no exploit is available.

Upgrading to version 5.18.3 eliminates this vulnerability. Applying the patch 896b03bb7c7010042786cfae2115083d4c241dd3/a962890a5a3cce903ff7c7a19fadee63ed9efdc7 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.18.0
• 5.18.1
• 5.18.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion