CVE-2024-53239
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2024-53239
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-53239.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2024-53239
- Downstream
- Related
- Published
- 2024-12-27T14:15:32Z
- Modified
- 2025-08-09T19:01:26Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
ALSA: 6fire: Release resources at card release
The current 6fire code tries to release the resources right after the call of usb6firechipabort(). But at this moment, the card object might be still in use (as we're calling sndcardfreewhenclosed()).
For avoid potential UAFs, move the release of resources to the card's privatefree instead of the manual call of usb6firechip_destroy() at the USB disconnect callback.
- References
-
- https://git.kernel.org/stable/c/0df7f4b5cc10f5adf98be0845372e9eef7bb5b09
- https://git.kernel.org/stable/c/273eec23467dfbfbd0e4c10302579ba441fb1e13
- https://git.kernel.org/stable/c/57860a80f03f9dc69a34a5c37b0941ad032a0a8c
- https://git.kernel.org/stable/c/74357d0b5cd3ef544752bc9f21cbeee4902fae6c
- https://git.kernel.org/stable/c/a0810c3d6dd2d29a9b92604d682eacd2902ce947
- https://git.kernel.org/stable/c/b754e831a94f82f2593af806741392903f359168
- https://git.kernel.org/stable/c/b889a7d68d7e76b8795b754a75c91a2d561d5e8c
- https://git.kernel.org/stable/c/ea8cc56db659cf0ae57073e32a4735ead7bd7ee3
- https://git.kernel.org/stable/c/f2d06d4e129e2508e356136f99bb20a332ff1a00