Log in Start free

Vulnerability · Published Jun 20, 2024 · Assigned by Linux

CVE-2022-48716ASoC: codecs: wcd938x: fix incorrect used of portid

High 7.8

In plain English

A high-severity uncontrolled resource consumption in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.5%top 60.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd938x: fix incorrect used of portid Mixer controls have the channel id in mixer->reg, which is not same as port id. port id should be derived from chan_info array. So fix this. Without this, its possible that we could corrupt struct wcd938x_sdw_priv by accessing port_map array out of range with channel id instead of port id.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.16.10-1DEBIAN-CVE-2022-48716
Debian:13linux5.16.10-1DEBIAN-CVE-2022-48716
Debian:14linux5.16.10-1DEBIAN-CVE-2022-48716
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-48716
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-48716
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-48716

Affected products (as reported)

VendorProductVersions
Linux Linux e8ba1e05bdc016700c85fad559a812c2e795442f – before aa7152f9f117b3e66b3c0d4158ca4c6d46ab229fe8ba1e05bdc016700c85fad559a812c2e795442f – before 9167f2712dc8c24964840a4d1e2ebf130e846b95e8ba1e05bdc016700c85fad559a812c2e795442f – before c5c1546a654f613e291a7c5d6f3660fc1eb6d0c7
Linux Linux 5.14

Weakness: CWE-400 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References