CVE-2022-48735

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: Fix UAF of leds class devs at unbinding

The LED class devices that are created by HD-audio codec drivers are registered via devm_led_classdev_register() and associated with the HD-audio codec device. Unfortunately, it turned out that the devres release doesnt work for this case; namely, since the codec resource release happens before the devm call chain, it triggers a NULL dereference or a UAF for a stale set_brightness_delay callback.

For fixing the bug, this patch changes the LED class device register and unregister in a manual manner without devres, keeping the instances in hda_gen_spec.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/0e629052f013eeb61494d4df2f1f647c2a9aef47
• https://git.kernel.org/stable/c/549f8ffc7b2f7561bea7f90930b6c5104318e87b
• https://git.kernel.org/stable/c/813e9f3e06d22e29872d4fd51b54992d89cf66c8
• https://git.kernel.org/stable/c/a7de1002135cf94367748ffc695a29812d7633b5
• https://git.kernel.org/stable/c/0e629052f013eeb61494d4df2f1f647c2a9aef47
• https://git.kernel.org/stable/c/549f8ffc7b2f7561bea7f90930b6c5104318e87b
• https://git.kernel.org/stable/c/813e9f3e06d22e29872d4fd51b54992d89cf66c8
• https://git.kernel.org/stable/c/a7de1002135cf94367748ffc695a29812d7633b5