Bug 2327176 (CVE-2024-50292) - CVE-2024-50292 kernel: ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
Summary: CVE-2024-50292 kernel: ASoC: stm32: spdifrx: fix dma channel release in stm32...
Keywords:
Status: NEW
Alias: CVE-2024-50292
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2327244
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-11-19 02:01 UTC by OSIDB Bzimport
Modified: 2024-11-21 19:02 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2024-11-19 02:01:54 UTC
In the Linux kernel, the following vulnerability has been resolved:

ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove

In case of error when requesting ctrl_chan DMA channel, ctrl_chan is not
null. So the release of the dma channel leads to the following issue:
[    4.879000] st,stm32-spdifrx 500d0000.audio-controller:
dma_request_slave_channel error -19
[    4.888975] Unable to handle kernel NULL pointer dereference
at virtual address 000000000000003d
[...]
[    5.096577] Call trace:
[    5.099099]  dma_release_channel+0x24/0x100
[    5.103235]  stm32_spdifrx_remove+0x24/0x60 [snd_soc_stm32_spdifrx]
[    5.109494]  stm32_spdifrx_probe+0x320/0x4c4 [snd_soc_stm32_spdifrx]

To avoid this issue, release channel only if the pointer is valid.

Comment 1 Avinash Hanwate 2024-11-19 05:43:55 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024111955-CVE-2024-50292-e8b6@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.