CVE - CVE-2022-48735

CVE-ID
CVE-2022-48735	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix UAF of leds class devs at unbinding The LED class devices that are created by HD-audio codec drivers are registered via devm_led_classdev_register() and associated with the HD-audio codec device. Unfortunately, it turned out that the devres release doesn't work for this case; namely, since the codec resource release happens before the devm call chain, it triggers a NULL dereference or a UAF for a stale set_brightness_delay callback. For fixing the bug, this patch changes the LED class device register and unregister in a manual manner without devres, keeping the instances in hda_gen_spec.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/0e629052f013eeb61494d4df2f1f647c2a9aef47 URL:https://git.kernel.org/stable/c/0e629052f013eeb61494d4df2f1f647c2a9aef47 MISC:https://git.kernel.org/stable/c/549f8ffc7b2f7561bea7f90930b6c5104318e87b URL:https://git.kernel.org/stable/c/549f8ffc7b2f7561bea7f90930b6c5104318e87b MISC:https://git.kernel.org/stable/c/813e9f3e06d22e29872d4fd51b54992d89cf66c8 URL:https://git.kernel.org/stable/c/813e9f3e06d22e29872d4fd51b54992d89cf66c8 MISC:https://git.kernel.org/stable/c/a7de1002135cf94367748ffc695a29812d7633b5 URL:https://git.kernel.org/stable/c/a7de1002135cf94367748ffc695a29812d7633b5
Assigning CNA
kernel.org
Date Record Created
20240620	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240620)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)