Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove() sof_es8336_remove() calls cancel_delayed_work(). However, that function does not wait until the work function finishes. This means that the callback function may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling cancel_delayed_work_sync(), which ensures that the work is properly cancelled, no longer running, and unable to re-schedule itself.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 6.0.11, < 6.0.16 |
Related Weaknesses (CWE)
References
- https://git.kernel.org/stable/c/1b41beaa7a58467505ec3023af8aad74f878b888Patch
- https://git.kernel.org/stable/c/390a1a98288a53b2e7555097d83c6e55d579b166Patch
- https://git.kernel.org/stable/c/b85102a3aa3810a09eb55692e8cd6ffbb304e57dPatch
FAQ
What is CVE-2022-50305?
CVE-2022-50305 is a vulnerability with a CVSS score of 7.8 (HIGH). In the Linux kernel, the following vulnerability has been resolved: ASoC: sof_es8336: fix possible use-after-free in sof_es8336_remove() sof_es8336_remove() calls cancel_delayed_work(). However, tha...
How severe is CVE-2022-50305?
CVE-2022-50305 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-50305?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel.