CVE-2022-48735— ALSA: hda: Fix UAF of leds class devs at unbinding
Affected Version Matrix 10
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 15509b6344726de22bdbfff88b65341dd0dd33af< a7de1002135cf94367748ffc695a29812d7633b5 | affected |
15509b6344726de22bdbfff88b65341dd0dd33af< 0e629052f013eeb61494d4df2f1f647c2a9aef47 | affected | ||
15509b6344726de22bdbfff88b65341dd0dd33af< 813e9f3e06d22e29872d4fd51b54992d89cf66c8 | affected | ||
15509b6344726de22bdbfff88b65341dd0dd33af< 549f8ffc7b2f7561bea7f90930b6c5104318e87b | affected | ||
5.9 | affected | ||
< 5.9 | unaffected | ||
5.10.99≤ 5.10.* | unaffected | ||
5.15.22≤ 5.15.* | unaffected | ||
| … +2 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-48735
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ALSA: hda: Fix UAF of leds class devs at unbinding
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix UAF of leds class devs at unbinding The LED class devices that are created by HD-audio codec drivers are registered via devm_led_classdev_register() and associated with the HD-audio codec device. Unfortunately, it turned out that the devres release doesn't work for this case; namely, since the codec resource release happens before the devm call chain, it triggers a NULL dereference or a UAF for a stale set_brightness_delay callback. For fixing the bug, this patch changes the LED class device register and unregister in a manual manner without devres, keeping the instances in hda_gen_spec.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于 ALSA:hda 模块解除绑定时 leds 类设备存在释放后重用漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-48735
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-48735
请登录查看更多情报信息。
Other References for CVE-2022-48735 (4)
Same Patch Batch · Linux · 2024-06-20 · 67 CVEs total
| CVE-2022-48751 | net/smc: Transitional solution for clcsock race issue | |
| CVE-2022-48770 | bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack() | |
| CVE-2022-48768 | tracing/histogram: Fix a potential memory leak for kstrdup() | |
| CVE-2022-48769 | efi: runtime: avoid EFIv2 runtime services on Apple x86 machines | |
| CVE-2022-48757 | net: fix information leakage in /proc/net/ptype | |
| CVE-2022-48756 | drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable | |
| CVE-2022-48755 | powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06 | |
| CVE-2022-48754 | phylib: fix potential use-after-free | |
| CVE-2022-48753 | block: fix memory leak in disk_register_independent_access_ranges | |
| CVE-2022-48752 | powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending | |
| CVE-2022-48758 | scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() | |
| CVE-2022-48750 | hwmon: (nct6775) Fix crash in clear_caseopen | |
| CVE-2022-48748 | net: bridge: vlan: fix memory leak in __allowed_ingress | |
| CVE-2022-48749 | drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc | |
| CVE-2022-48747 | block: Fix wrong offset in bio_truncate() | |
| CVE-2022-48745 | net/mlx5: Use del_timer_sync in fw reset flow of halting poll | |
| CVE-2022-48746 | net/mlx5e: Fix handling of wrong devices during bond netevent | |
| CVE-2022-48744 | net/mlx5e: Avoid field-overflowing memcpy() | |
| CVE-2022-48743 | net: amd-xgbe: Fix skb data length underflow | |
| CVE-2022-48742 | rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() |
Showing top 20 of 67 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing - CVE-2026-43503
net: skbuff: propagate shared-frag marker through frag-trans - CVE-2026-43502
net/rds: handle zerocopy send cleanup before the message is - CVE-2026-43501
ipv6: rpl: reserve mac_len headroom when recompressed SRH gr - CVE-2026-43498
accel/ivpu: Disallow re-exporting imported GEM objects
Same vendor: Linux
- CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing - CVE-2026-43503
net: skbuff: propagate shared-frag marker through frag-trans - CVE-2026-43502
net/rds: handle zerocopy send cleanup before the message is - CVE-2026-43501
ipv6: rpl: reserve mac_len headroom when recompressed SRH gr - CVE-2026-43498
accel/ivpu: Disallow re-exporting imported GEM objects
V. Comments for CVE-2022-48735
No comments yet