CVE-2022-50049

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ASoC: DPCM: Don't pick up BE without substream

When DPCM tries to add valid BE connections at dpcm_add_paths(), it

doesn't check whether the picked BE actually supports for the given

stream direction. Due to that, when an asymmetric BE stream is

present, it picks up wrongly and this may result in a NULL dereference

at a later point where the code assumes the existence of a

corresponding BE substream.

This patch adds the check for the presence of the substream for the

target BE for avoiding the problem above.

Note that we have already some fix for non-existing BE substream at

commit 6246f283d5e0 ("ASoC: dpcm: skip missing substream while

applying symmetry"). But the code path we've hit recently is rather

happening before the previous fix. So this patch tries to fix at

picking up a BE instead of parsing BE lists.

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References