CVE-2022-50015
published 2025-06-18CVE-2022-50015: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot It is not yet…
PriorityP419medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.18%
7.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot
It is not yet clear, but it is possible to create a firmware so broken
that it will send a reply message before a FW_READY message (it is not
yet clear if FW_READY will arrive later).
Since the reply_data is allocated only after the FW_READY message, this
will lead to a NULL pointer dereference if not filtered out.
The issue was reported with IPC4 firmware but the same condition is present
for IPC3.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 5.19.6-1 (bookworm) | linux 5.19.6-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 6e9cde974863dc9d9c6cdb178f625e410c5be3d0 < 48945246cf802b9866f3a821103f1a7a196baf68 | 48945246cf802b9866f3a821103f1a7a196baf68 |
| linux | linux | >= 6e9cde974863dc9d9c6cdb178f625e410c5be3d0 < 499cc881b09c8283ab5e75b0d6d21cb427722161 | 499cc881b09c8283ab5e75b0d6d21cb427722161 |
| linux | linux_kernel | >= 0 < 5.19.6-1 | 5.19.6-1 |
| linux | linux_kernel | >= 0 < 5.19.6-1 | 5.19.6-1 |
| linux | linux_kernel | >= 0 < 5.19.6-1 | 5.19.6-1 |
| linux | linux_kernel | >= 5.2 < 5.19.4 | 5.19.4 |
| msrc | cbl2_kernel_5.15.186.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.200.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.202.1-1_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM
vendor_msrc6.6MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-57q3-hh7m-q296: In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot
It is n
ghsa_unreviewed·2025-06-18
CVE-2022-50015 [MEDIUM] CWE-476 GHSA-57q3-hh7m-q296: In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot
It is n
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot
It is not yet clear, but it is possible to create a firmware so broken
that it will send a reply message before a FW_READY message (it is not
yet clear if FW_READY will arrive later).
Since the reply_data is allocated only after the FW_READY message, this
will lead to a NULL pointer dereference if not filtered out.
The issue was reported with IPC4 firmware but the same condition is present
for IPC3.
OSV
CVE-2022-50015: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot It is not
osv·2025-06-18·CVSS 5.5
CVE-2022-50015 [MEDIUM] CVE-2022-50015: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot It is not
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FW_READY message (it is not yet clear if FW_READY will arrive later). Since the reply_data is allocated only after the FW_READY message, this will lead to a NULL pointer dereference if not filtered out. The issue was reported with IPC4 firmware but the same condition is present for IPC3.
Red Hat
kernel: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot
vendor_redhat·2025-06-18·CVSS 5.5
CVE-2022-50015 [MEDIUM] kernel: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot
kernel: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot
It is not yet clear, but it is possible to create a firmware so broken
that it will send a reply message before a FW_READY message (it is not
yet clear if FW_READY will arrive later).
Since the reply_data is allocated only after the FW_READY message, this
will lead to a NULL pointer dereference if not filtered out.
The issue was reported with IPC4 firmware but the same condition is present
for IPC3.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not
Microsoft
ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot
vendor_msrc·2025-06-10·CVSS 6.6
CVE-2022-50015 [MEDIUM] CWE-476 ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot
ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Debian
CVE-2022-50015: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ...
vendor_debian·2022·CVSS 5.5
CVE-2022-50015 [MEDIUM] CVE-2022-50015: linux - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ...
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FW_READY message (it is not yet clear if FW_READY will arrive later). Since the reply_data is allocated only after the FW_READY message, this will lead to a NULL pointer dereference if not filtered out. The issue was reported with IPC4 firmware but the same condition is present for IPC3.
Scope: local
bookworm: resolved (fixed in 5.19.6-1)
bullseye: open
forky: resolved (fixed in 5.19.6-1)
sid: resolved (fixed in 5.19.6-1)
trixie: resolved (fixed in 5.19.6-1)
No detection rules found.
No public exploits indexed.
2025-06-18
Published