In the Linux kernel, the following vulnerability has been resolved:
ASoC: dapm: Fix UAF for sndsocpcm_runtime object
When using kernel with the following extra config,
kernel detects that sndpcmsuspendall() access a freed 'sndsocpcmruntime' object when the system is suspended, which leads to a use-after-free bug:
[ 52.047746] BUG: KASAN: use-after-free in sndpcmsuspend_all+0x1a8/0x270 [ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330
[ 52.047785] Call trace: [ 52.047787] dumpbacktrace+0x0/0x3c0 [ 52.047794] showstack+0x34/0x50 [ 52.047797] dumpstacklvl+0x68/0x8c [ 52.047802] printaddressdescription.constprop.0+0x74/0x2c0 [ 52.047809] kasanreport+0x210/0x230 [ 52.047815] _asanreportload1noabort+0x3c/0x50 [ 52.047820] sndpcmsuspendall+0x1a8/0x270 [ 52.047824] sndsocsuspend+0x19c/0x4e0
The sndpcmsync_stop() has a NULL check on 'substream->runtime' before making any access. So we need to always set 'substream->runtime' to NULL everytime we kfree() it.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a14fad8be178df6c4589667efec1789a3307b4e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "snd_soc_dai_link_event",
"file": "sound/soc/soc-dapm.c"
},
"id": "CVE-2024-46798-18a7ba6f",
"digest": {
"length": 1701.0,
"function_hash": "65611136196111131322145604397894957628"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3033ed903b4f28b5e1ab66042084fbc2c48f8624",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "sound/soc/soc-dapm.c"
},
"id": "CVE-2024-46798-1ce1f44e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193645836928573873275284063299908095783",
"199898235283711222807513038536693485167",
"323134804857291330735510074040247077319",
"84786970153352097633970187904137879489"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6a14fad8be178df6c4589667efec1789a3307b4e",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "sound/soc/soc-dapm.c"
},
"id": "CVE-2024-46798-3b034cd9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193645836928573873275284063299908095783",
"199898235283711222807513038536693485167",
"323134804857291330735510074040247077319",
"84786970153352097633970187904137879489"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d13afd021eb43868fe03cef6da34ad08831ad6d",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "snd_soc_dai_link_event",
"file": "sound/soc/soc-dapm.c"
},
"id": "CVE-2024-46798-47e57632",
"digest": {
"length": 1701.0,
"function_hash": "65611136196111131322145604397894957628"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@993b60c7f93fa1d8ff296b58f646a867e945ae89",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "sound/soc/soc-dapm.c"
},
"id": "CVE-2024-46798-5dec57f2",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193645836928573873275284063299908095783",
"199898235283711222807513038536693485167",
"323134804857291330735510074040247077319",
"84786970153352097633970187904137879489"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5d13afd021eb43868fe03cef6da34ad08831ad6d",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "sound/soc/soc-dapm.c"
},
"id": "CVE-2024-46798-84be2f42",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193645836928573873275284063299908095783",
"199898235283711222807513038536693485167",
"323134804857291330735510074040247077319",
"84786970153352097633970187904137879489"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3033ed903b4f28b5e1ab66042084fbc2c48f8624",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "snd_soc_dai_link_event",
"file": "sound/soc/soc-dapm.c"
},
"id": "CVE-2024-46798-a024f607",
"digest": {
"length": 1701.0,
"function_hash": "65611136196111131322145604397894957628"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe5046ca91d631ec432eee3bdb1f1c49b09c8b5e",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "snd_soc_dai_link_event",
"file": "sound/soc/soc-dapm.c"
},
"id": "CVE-2024-46798-bb1588e1",
"digest": {
"length": 1701.0,
"function_hash": "65611136196111131322145604397894957628"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@993b60c7f93fa1d8ff296b58f646a867e945ae89",
"signature_version": "v1",
"deprecated": false,
"target": {
"function": "snd_soc_dai_link_event",
"file": "sound/soc/soc-dapm.c"
},
"id": "CVE-2024-46798-d91a7756",
"digest": {
"length": 1867.0,
"function_hash": "93112597605632817335091921062650442621"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fe5046ca91d631ec432eee3bdb1f1c49b09c8b5e",
"signature_version": "v1",
"deprecated": false,
"target": {
"file": "sound/soc/soc-dapm.c"
},
"id": "CVE-2024-46798-fc359d11",
"digest": {
"threshold": 0.9,
"line_hashes": [
"193645836928573873275284063299908095783",
"199898235283711222807513038536693485167",
"323134804857291330735510074040247077319",
"84786970153352097633970187904137879489"
]
},
"signature_type": "Line"
}
]