CVE-2021-47502 ASoC: codecs: wcd934x: handle channel mappping list correctly
A memory corruption vulnerability in the Linux kernel's WCD934x audio codec driver allows attackers to corrupt data structures, potentially leading to system crashes or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-47502?
CVE-2021-47502 is a high-severity memory corruption vulnerability in Linux kernel, published on 24 May 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: codecs: wcd934x: handle channel mappping list correctly
Currently each channel is added as list to dai channel list, however there is danger of adding same channel to multiple dai channel list which endups corrupting the other list where its already added.
This patch ensures that the channel is actually free before adding to the dai channel list and also ensures that the channel is on the list before deleting it.
This check was missing previously, and we did not hit this issue as we were testing very simple usecases with sequence of amixer commands.
Which versions are affected by CVE-2021-47502?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2021-47502?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-47502 being exploited?
There is no known exploitation of CVE-2021-47502 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2021-47502, UBUNTU-CVE-2021-47502.