In the Linux kernel, the following vulnerability has been resolved:
ASoC: stm32: spdifrx: fix dma channel release in stm32spdifrxremove
In case of error when requesting ctrlchan DMA channel, ctrlchan is not null. So the release of the dma channel leads to the following issue: [ 4.879000] st,stm32-spdifrx 500d0000.audio-controller: dmarequestslavechannel error -19 [ 4.888975] Unable to handle kernel NULL pointer dereference at virtual address 000000000000003d [...] [ 5.096577] Call trace: [ 5.099099] dmareleasechannel+0x24/0x100 [ 5.103235] stm32spdifrxremove+0x24/0x60 [sndsocstm32spdifrx] [ 5.109494] stm32spdifrxprobe+0x320/0x4c4 [sndsocstm32_spdifrx]
To avoid this issue, release channel only if the pointer is valid.
[
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/stm/stm32_spdifrx.c",
"function": "stm32_spdifrx_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d75f887aabd80cf37ea48d28f159afa7850ea28",
"digest": {
"length": 251.0,
"function_hash": "94174302675108746920582222894039479326"
},
"id": "CVE-2024-50292-2db665c4"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/stm/stm32_spdifrx.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9bb4af400c386374ab1047df44c508512c08c31f",
"digest": {
"line_hashes": [
"219695212448040442584575396567741503698",
"195376666091848502488852729361582060198",
"112797081344377723309113142137077847878",
"308649002487200232654785062364327163821"
],
"threshold": 0.9
},
"id": "CVE-2024-50292-2edaefac"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/stm/stm32_spdifrx.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a977b554f668382dfba31fd62e4cce4fe5643db",
"digest": {
"line_hashes": [
"120614298530358945492439998619907573569",
"195376666091848502488852729361582060198",
"112797081344377723309113142137077847878",
"308649002487200232654785062364327163821"
],
"threshold": 0.9
},
"id": "CVE-2024-50292-3951fa0b"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/stm/stm32_spdifrx.c",
"function": "stm32_spdifrx_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23bdbd1ef3e063e03d3c50c15a591b005ebbae39",
"digest": {
"length": 270.0,
"function_hash": "29216082227540504855056857012839865468"
},
"id": "CVE-2024-50292-3e9b31d6"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/stm/stm32_spdifrx.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0d75f887aabd80cf37ea48d28f159afa7850ea28",
"digest": {
"line_hashes": [
"120614298530358945492439998619907573569",
"195376666091848502488852729361582060198",
"112797081344377723309113142137077847878",
"308649002487200232654785062364327163821"
],
"threshold": 0.9
},
"id": "CVE-2024-50292-4d4c726c"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/stm/stm32_spdifrx.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22ae9321054cf7f36c537702af133659f51a0b88",
"digest": {
"line_hashes": [
"219695212448040442584575396567741503698",
"195376666091848502488852729361582060198",
"112797081344377723309113142137077847878",
"308649002487200232654785062364327163821"
],
"threshold": 0.9
},
"id": "CVE-2024-50292-5d9e0fe7"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/stm/stm32_spdifrx.c",
"function": "stm32_spdifrx_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3a977b554f668382dfba31fd62e4cce4fe5643db",
"digest": {
"length": 251.0,
"function_hash": "94174302675108746920582222894039479326"
},
"id": "CVE-2024-50292-71111352"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/stm/stm32_spdifrx.c",
"function": "stm32_spdifrx_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f1d74f74752eab8af6b8b28797dc6490d57374c",
"digest": {
"length": 281.0,
"function_hash": "277123399922576017652809178429961542008"
},
"id": "CVE-2024-50292-7b928536"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/stm/stm32_spdifrx.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@23bdbd1ef3e063e03d3c50c15a591b005ebbae39",
"digest": {
"line_hashes": [
"219695212448040442584575396567741503698",
"195376666091848502488852729361582060198",
"112797081344377723309113142137077847878",
"308649002487200232654785062364327163821"
],
"threshold": 0.9
},
"id": "CVE-2024-50292-95f59888"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/stm/stm32_spdifrx.c",
"function": "stm32_spdifrx_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@22ae9321054cf7f36c537702af133659f51a0b88",
"digest": {
"length": 270.0,
"function_hash": "29216082227540504855056857012839865468"
},
"id": "CVE-2024-50292-9a1a2c10"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/stm/stm32_spdifrx.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f1d74f74752eab8af6b8b28797dc6490d57374c",
"digest": {
"line_hashes": [
"120614298530358945492439998619907573569",
"195376666091848502488852729361582060198",
"112797081344377723309113142137077847878",
"308649002487200232654785062364327163821"
],
"threshold": 0.9
},
"id": "CVE-2024-50292-d145bd6f"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/stm/stm32_spdifrx.c",
"function": "stm32_spdifrx_remove"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9bb4af400c386374ab1047df44c508512c08c31f",
"digest": {
"length": 270.0,
"function_hash": "29216082227540504855056857012839865468"
},
"id": "CVE-2024-50292-ed59fe62"
}
]