CVE-2022-49493

Summary

CVE-2022-49493 is a logic error vulnerability affecting the Linux kernel's ASoC (Audio Subsystem On Chip) driver for the rt5645 chip. The issue lies in the order of operations during the removal of an rt5645 device. Specifically, the function rt5645_i2c_remove first cancels the jack_detect_work and deletes the btn_check_timer, but since the timer handler rt5645_btn_check_callback can re-queue the jack_detect_work, this cleanup order is buggy. This leads to a potential use-after-free vulnerability. The patch fixes the issue by swapping the order of the del_timer_sync and cancel_delayed_work_sync functions.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.