SB20250226280 - Use-after-free in Linux kernel sof intel
Published: February 26, 2025 Updated: May 11, 2025
Security Bulletin ID
SB20250226280
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Use-after-free (CVE-ID: CVE-2022-49268)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a use-after-free error within the cl_stream_prepare() function in sound/soc/sof/intel/hda-loader.c. A local user can escalate privileges on the system.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/01df5f7627f1624d6bb0b8c0870a569b32adfbf8
- https://git.kernel.org/stable/c/09eca322d4118dc26570ca6100fa34e59e5a5143
- https://git.kernel.org/stable/c/0c307349fe060971625b856c92f0361b8ea9a120
- https://git.kernel.org/stable/c/67f7bd9ff9079c1ee2de58e024fb582905c74c16
- https://git.kernel.org/stable/c/b6094744e261083d3790c3def770ebf5060d383b
- https://git.kernel.org/stable/c/b7fb0ae09009d076964afe4c1a2bde1ee2bd88a9
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.110
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.33
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.19
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.2
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18
- https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.189