CVE-2024-41037

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-41037
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: fix null deref on system suspend entry When system enters suspend with an active stream, SOF core calls hw_params_upon_resume(). On Intel platforms with HDA DMA used to manage the link DMA, this leads to call chain of hda_dsp_set_hw_params_upon_resume() -> hda_dsp_dais_suspend() -> hda_dai_suspend() -> hda_ipc4_post_trigger() A bug is hit in hda_dai_suspend() as hda_link_dma_cleanup() is run first, which clears hext_stream->link_substream, and then hda_ipc4_post_trigger() is called with a NULL snd_pcm_substream pointer.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/8246bbf818ed7b8d5afc92b951e6d562b45c2450 Patch
https://git.kernel.org/stable/c/9065693dcc13f287b9e4991f43aee70cf5538fdd Patch
https://git.kernel.org/stable/c/993af0f2d9f24e3c18a445ae22b34190d1fcad61 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

08 Aug 2024, 17:53

Type Values Removed Values Added
CWE CWE-476
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: ASoC: SOF: Intel: hda: corrige el deref nulo en la entrada de suspensión del sistema Cuando el sistema entra en suspensión con una secuencia activa, el núcleo de SOF llama a hw_params_upon_resume(). En las plataformas Intel con HDA DMA utilizado para administrar el enlace DMA, esto conduce a la cadena de llamadas de hda_dsp_set_hw_params_upon_resume() -> hda_dsp_dais_suspend() -> hda_dai_suspend() -> hda_ipc4_post_trigger() Se detecta un error en hda_dai_suspend() como hda_link_dma_cleanup() ejecutar primero, lo que borra hext_stream->link_substream, y luego se llama a hda_ipc4_post_trigger() con un puntero NULL snd_pcm_substream.
References () https://git.kernel.org/stable/c/8246bbf818ed7b8d5afc92b951e6d562b45c2450 - () https://git.kernel.org/stable/c/8246bbf818ed7b8d5afc92b951e6d562b45c2450 - Patch
References () https://git.kernel.org/stable/c/9065693dcc13f287b9e4991f43aee70cf5538fdd - () https://git.kernel.org/stable/c/9065693dcc13f287b9e4991f43aee70cf5538fdd - Patch
References () https://git.kernel.org/stable/c/993af0f2d9f24e3c18a445ae22b34190d1fcad61 - () https://git.kernel.org/stable/c/993af0f2d9f24e3c18a445ae22b34190d1fcad61 - Patch
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Linux linux Kernel

29 Jul 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-29 15:15

Updated : 2024-08-08 17:53

NVD link : CVE-2024-41037

Mitre link : CVE-2024-41037

CVE.ORG link : CVE-2024-41037

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference