Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2022-49161
CVE-2022-49161:
Linux Debian vulnerability analysis and mitigation
Overview
CVE-2022-49161 affects the Linux kernel's ASoC (ALSA System on Chip) MediaTek driver. The vulnerability was discovered in the mt8183da7219max98357devprobe function where a devicenode pointer returned by ofparse_phandle() with an incremented refcount was not properly managed in error paths, leading to a potential reference count leak (Kernel Git).
Technical details
The vulnerability exists in the error handling paths of the mt8183da7219max98357devprobe function. The function only called ofnodeput() in the regular execution path but failed to release the reference count in error paths. This oversight could lead to a reference count leak when error conditions are encountered (Kernel Git).
Impact
The reference count leak in the kernel's memory management system could potentially lead to memory resource exhaustion over time, though the practical impact would likely be minimal as it only occurs in error paths of the MediaTek audio driver initialization (Debian Tracker).
Mitigation and workarounds
The issue has been fixed by adding proper ofnodeput() calls in the error handling paths. The fix has been incorporated into various Linux distributions, including Debian bookworm and later versions. Systems running affected versions should update to the patched versions (Debian Tracker).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management