CVE-2024-39473

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-39473
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension If a process module does not have base config extension then the same format applies to all of it's inputs and the process->base_config_ext is NULL, causing NULL dereference when specifically crafted topology and sequences used.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/9e16f17a2a0e97b43538b272e7071537a3e03368 Mailing List Patch
https://git.kernel.org/stable/c/e3ae00ee238bce6cfa5ad935c921181c14d18fd6 Mailing List Patch
https://git.kernel.org/stable/c/ffa077b2f6ad124ec3d23fbddc5e4b0ff2647af8 Mailing List Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10.0:rc1:*:*:*:*:*:*
History

08 Jul 2024, 17:12

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-476
References () https://git.kernel.org/stable/c/9e16f17a2a0e97b43538b272e7071537a3e03368 - () https://git.kernel.org/stable/c/9e16f17a2a0e97b43538b272e7071537a3e03368 - Mailing List, Patch
References () https://git.kernel.org/stable/c/e3ae00ee238bce6cfa5ad935c921181c14d18fd6 - () https://git.kernel.org/stable/c/e3ae00ee238bce6cfa5ad935c921181c14d18fd6 - Mailing List, Patch
References () https://git.kernel.org/stable/c/ffa077b2f6ad124ec3d23fbddc5e4b0ff2647af8 - () https://git.kernel.org/stable/c/ffa077b2f6ad124ec3d23fbddc5e4b0ff2647af8 - Mailing List, Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.10.0:rc1:*:*:*:*:*:*
First Time Linux
Linux linux Kernel

05 Jul 2024, 12:55

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ASoC: SOF: ipc4-topology: arregla la consulta de formato de entrada de módulos de proceso sin extensión base. Si un módulo de proceso no tiene extensión de configuración base, entonces se aplica el mismo formato a todas sus entradas. y el proceso->base_config_ext es NULL, lo que provoca una desreferencia NULL cuando se utilizan secuencias y topologías manipuladas específicamente.

05 Jul 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-05 07:15

Updated : 2024-07-08 17:12

NVD link : CVE-2024-39473

Mitre link : CVE-2024-39473

CVE.ORG link : CVE-2024-39473

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference