linux-cve-announce - CVE-2022-49835: ALSA: hda: fix potential memleak in 'add_widget

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025050138-CVE-2022-49835-ea42@gregkh>
Date: Thu,  1 May 2025 16:10:25 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-49835: ALSA: hda: fix potential memleak in 'add_widget_node'

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: fix potential memleak in 'add_widget_node'

As 'kobject_add' may allocated memory for 'kobject->name' when return error.
And in this function, if call 'kobject_add' failed didn't free kobject.
So call 'kobject_put' to recycling resources.

The Linux kernel CVE team has assigned CVE-2022-49835 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.9.334 with commit b688a3ec235222d9a84e43a48a6f31acb95baf2d
	Fixed in 4.14.300 with commit bb0ac8d5e541224f599bc8e8f31a313faa4bf7b7
	Fixed in 4.19.267 with commit 90b7d055e2b5f39429f9a9e3815b48a48530ef28
	Fixed in 5.4.225 with commit 02dea987ec1cac712c78e75d224ceb9bb73519ed
	Fixed in 5.10.155 with commit 3a79f9568de08657fcdbc41d6fc4c0ca145a7a2b
	Fixed in 5.15.79 with commit 7140d7aaf93da6a665b454f91bb4dc6b1de218bd
	Fixed in 6.0.9 with commit 455d99bd6baf19688048b6d42d9fa74eae27f93b
	Fixed in 6.1 with commit 9a5523f72bd2b0d66eef3d58810c6eb7b5ffc143

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49835
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/hda/hdac_sysfs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/b688a3ec235222d9a84e43a48a6f31acb95baf2d
	https://git.kernel.org/stable/c/bb0ac8d5e541224f599bc8e8f31a313faa4bf7b7
	https://git.kernel.org/stable/c/90b7d055e2b5f39429f9a9e3815b48a48530ef28
	https://git.kernel.org/stable/c/02dea987ec1cac712c78e75d224ceb9bb73519ed
	https://git.kernel.org/stable/c/3a79f9568de08657fcdbc41d6fc4c0ca145a7a2b
	https://git.kernel.org/stable/c/7140d7aaf93da6a665b454f91bb4dc6b1de218bd
	https://git.kernel.org/stable/c/455d99bd6baf19688048b6d42d9fa74eae27f93b
	https://git.kernel.org/stable/c/9a5523f72bd2b0d66eef3d58810c6eb7b5ffc143