linux-cve-announce - CVE-2022-49842: ASoC: core: Fix use-after-free in snd_soc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025050140-CVE-2022-49842-54c5@gregkh>
Date: Thu,  1 May 2025 16:10:32 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-49842: ASoC: core: Fix use-after-free in snd_soc_exit()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ASoC: core: Fix use-after-free in snd_soc_exit()

KASAN reports a use-after-free:

BUG: KASAN: use-after-free in device_del+0xb5b/0xc60
Read of size 8 at addr ffff888008655050 by task rmmod/387
CPU: 2 PID: 387 Comm: rmmod
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
Call Trace:
<TASK>
dump_stack_lvl+0x79/0x9a
print_report+0x17f/0x47b
kasan_report+0xbb/0xf0
device_del+0xb5b/0xc60
platform_device_del.part.0+0x24/0x200
platform_device_unregister+0x2e/0x40
snd_soc_exit+0xa/0x22 [snd_soc_core]
__do_sys_delete_module.constprop.0+0x34f/0x5b0
do_syscall_64+0x3a/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
...
</TASK>

It's bacause in snd_soc_init(), snd_soc_util_init() is possble to fail,
but its ret is ignored, which makes soc_dummy_dev unregistered twice.

snd_soc_init()
    snd_soc_util_init()
        platform_device_register_simple(soc_dummy_dev)
        platform_driver_register() # fail
    	platform_device_unregister(soc_dummy_dev)
    platform_driver_register() # success
...
snd_soc_exit()
    snd_soc_util_exit()
    # soc_dummy_dev will be unregistered for second time

To fix it, handle error and stop snd_soc_init() when util_init() fail.
Also clean debugfs when util_init() or driver_register() fail.

The Linux kernel CVE team has assigned CVE-2022-49842 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.0 with commit fb257897bf20c5f0e1df584bb5b874e811651263 and fixed in 4.9.334 with commit 41fad4f712e081acdfde8b59847f9f66eaf407a0
	Issue introduced in 3.0 with commit fb257897bf20c5f0e1df584bb5b874e811651263 and fixed in 4.14.300 with commit 90bbdf30a51e42378cb23a312005a022794b8e1e
	Issue introduced in 3.0 with commit fb257897bf20c5f0e1df584bb5b874e811651263 and fixed in 4.19.267 with commit a3365e62239dc064019a244bde5686ac18527c22
	Issue introduced in 3.0 with commit fb257897bf20c5f0e1df584bb5b874e811651263 and fixed in 5.4.225 with commit 2ec3f558db343b045a7c7419cdbaec266b8ac1a7
	Issue introduced in 3.0 with commit fb257897bf20c5f0e1df584bb5b874e811651263 and fixed in 5.10.156 with commit 8d21554ec7680e9585fb852d933203c3db60dad1
	Issue introduced in 3.0 with commit fb257897bf20c5f0e1df584bb5b874e811651263 and fixed in 5.15.80 with commit 34eee4189bcebbd5f6a2ff25ef0cb893ad33d51e
	Issue introduced in 3.0 with commit fb257897bf20c5f0e1df584bb5b874e811651263 and fixed in 6.0.10 with commit c5674bd073c0fd9f620ca550c5ff08d0d429bdd9
	Issue introduced in 3.0 with commit fb257897bf20c5f0e1df584bb5b874e811651263 and fixed in 6.1 with commit 6ec27c53886c8963729885bcf2dd996eba2767a7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-49842
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/soc/soc-core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/41fad4f712e081acdfde8b59847f9f66eaf407a0
	https://git.kernel.org/stable/c/90bbdf30a51e42378cb23a312005a022794b8e1e
	https://git.kernel.org/stable/c/a3365e62239dc064019a244bde5686ac18527c22
	https://git.kernel.org/stable/c/2ec3f558db343b045a7c7419cdbaec266b8ac1a7
	https://git.kernel.org/stable/c/8d21554ec7680e9585fb852d933203c3db60dad1
	https://git.kernel.org/stable/c/34eee4189bcebbd5f6a2ff25ef0cb893ad33d51e
	https://git.kernel.org/stable/c/c5674bd073c0fd9f620ca550c5ff08d0d429bdd9
	https://git.kernel.org/stable/c/6ec27c53886c8963729885bcf2dd996eba2767a7