CVE-2022-50115

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-50115

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes We have sanity checks for byte controls and if any of the fail the locally allocated scontrol->ipc_control_data is freed up, but not set to NULL. On a rollback path of the error the higher level code will also try to free the scontrol->ipc_control_data which will eventually going to lead to memory corruption as double freeing memory is not a good thing.

References
Link Resource
https://git.kernel.org/stable/c/8463986b54295e6b65ddf2b7c65627d01ce7643b Patch
https://git.kernel.org/stable/c/c2eddfcafcffaf1b9245ea0dde9143bbfb47d5d1 Patch
https://git.kernel.org/stable/c/d5bd47f3ca124058a8e87eae4508afeda2132611 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

18 Nov 2025, 18:13

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
First Time Linux linux Kernel
Linux
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ASoC: SOF: ipc3-topology: Impide la doble liberación de ipc_control_data mediante load_bytes. Se han realizado comprobaciones de seguridad para los controles de bytes y, si alguna falla, se libera el archivo scontrol->ipc_control_data asignado localmente, pero no se establece en NULL. En una ruta de reversión del error, el código de nivel superior también intentará liberar scontrol->ipc_control_data, lo que eventualmente provocará corrupción de memoria, ya que la doble liberación de memoria no es recomendable.
References () https://git.kernel.org/stable/c/8463986b54295e6b65ddf2b7c65627d01ce7643b - () https://git.kernel.org/stable/c/8463986b54295e6b65ddf2b7c65627d01ce7643b - Patch
References () https://git.kernel.org/stable/c/c2eddfcafcffaf1b9245ea0dde9143bbfb47d5d1 - () https://git.kernel.org/stable/c/c2eddfcafcffaf1b9245ea0dde9143bbfb47d5d1 - Patch
References () https://git.kernel.org/stable/c/d5bd47f3ca124058a8e87eae4508afeda2132611 - () https://git.kernel.org/stable/c/d5bd47f3ca124058a8e87eae4508afeda2132611 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CWE CWE-415

18 Jun 2025, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-18 11:15

Updated : 2025-11-18 18:13

NVD link : CVE-2022-50115

Mitre link : CVE-2022-50115

CVE.ORG link : CVE-2022-50115

JSON object : View

Products Affected

linux

CWE
CWE-415

Double Free