In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP
The linkDMA should not be released on stop trigger since a stream re-start might happen without closing of the stream. This leaves a short time for other streams to 'steal' the linkDMA since it has been released.
This issue is not easy to reproduce under normal conditions as usually after stop the stream is closed, or the same stream is restarted, but if another stream got in between the stop and start, like this: aplay -Dhw:0,3 -c2 -r48000 -fS32LE /dev/zero -d 120 CTRL+z aplay -Dhw:0,0 -c2 -r48000 -fS32LE /dev/zero -d 120
then the link DMA channels will be mixed up, resulting firmware error or crash.
[
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/sof/intel/hda-dai.c",
"function": "hda_dai_suspend"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d0ba147d901022bcb69da8d8fd817f84e9f3ca",
"digest": {
"length": 898.0,
"function_hash": "319097807580159726559001461652869557671"
},
"id": "CVE-2024-57805-04cd1ce1"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/sof/intel/hda-dai.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@909ecf15cb70f78cdb5c930f58df01db039a0ff8",
"digest": {
"line_hashes": [
"101075889076100270663707441467579478044",
"137208560379752002930122763833250524114",
"120445950129251875169865337644099175919",
"63218335563593908487133517153272095782",
"161665155440670553332733952992508262103",
"93415258998223343138545921855969439868",
"58946493083780972183529902255258055798",
"156195116620168058209396381147599951586",
"217051887749891267485787115871512181453",
"52877865281374609553465658112905993700",
"256771583621138615708237574466737034032",
"168066043351653769792756548895548139525",
"262246375274439730967405795118488621513",
"91274635466130748930405488023206431679",
"336363834352695977113664699486343114658",
"331254846310634345999837014759907695071",
"91521265089100006428636577061575969404",
"211286126310927810475752320602233806788",
"65966036400875608810251887778553833305",
"265438504176463268531895047247307074690",
"118688681296742419811127835152562880267"
],
"threshold": 0.9
},
"id": "CVE-2024-57805-07aa1446"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/sof/intel/hda.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d0ba147d901022bcb69da8d8fd817f84e9f3ca",
"digest": {
"line_hashes": [
"138678190007025451877666602311946918953",
"55898466238003325288222360533877692171",
"258700823230349973945928274313124911447",
"29198128818619327323735028072522920969",
"330544435476741320753325869713369951317"
],
"threshold": 0.9
},
"id": "CVE-2024-57805-0fece094"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/sof/intel/hda-dai.c",
"function": "hda_dai_trigger"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@909ecf15cb70f78cdb5c930f58df01db039a0ff8",
"digest": {
"length": 1092.0,
"function_hash": "329938755589604348670179978516212278377"
},
"id": "CVE-2024-57805-113031fe"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/sof/intel/hda-dai.c",
"function": "hda_link_dma_cleanup"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@909ecf15cb70f78cdb5c930f58df01db039a0ff8",
"digest": {
"length": 666.0,
"function_hash": "46941135675595135660311335945666230212"
},
"id": "CVE-2024-57805-20fea0fb"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/sof/intel/hda-dai.c",
"function": "hda_dai_hw_free"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@909ecf15cb70f78cdb5c930f58df01db039a0ff8",
"digest": {
"length": 378.0,
"function_hash": "265446000850863662572387205421222382384"
},
"id": "CVE-2024-57805-3208afa4"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/sof/intel/hda-dai.c",
"function": "hda_dai_suspend"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@909ecf15cb70f78cdb5c930f58df01db039a0ff8",
"digest": {
"length": 795.0,
"function_hash": "3047687661937504449617932491092807117"
},
"id": "CVE-2024-57805-3ee76087"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/sof/intel/hda.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@909ecf15cb70f78cdb5c930f58df01db039a0ff8",
"digest": {
"line_hashes": [
"138678190007025451877666602311946918953",
"55898466238003325288222360533877692171",
"258700823230349973945928274313124911447",
"29198128818619327323735028072522920969",
"330544435476741320753325869713369951317"
],
"threshold": 0.9
},
"id": "CVE-2024-57805-44af1347"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/sof/intel/hda-dai.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d0ba147d901022bcb69da8d8fd817f84e9f3ca",
"digest": {
"line_hashes": [
"101075889076100270663707441467579478044",
"137208560379752002930122763833250524114",
"120445950129251875169865337644099175919",
"63218335563593908487133517153272095782",
"161665155440670553332733952992508262103",
"93415258998223343138545921855969439868",
"58946493083780972183529902255258055798",
"156195116620168058209396381147599951586",
"217051887749891267485787115871512181453",
"52877865281374609553465658112905993700",
"256771583621138615708237574466737034032",
"168066043351653769792756548895548139525",
"262246375274439730967405795118488621513",
"91274635466130748930405488023206431679",
"336363834352695977113664699486343114658",
"331254846310634345999837014759907695071",
"91521265089100006428636577061575969404",
"211286126310927810475752320602233806788",
"65966036400875608810251887778553833305",
"265438504176463268531895047247307074690",
"118688681296742419811127835152562880267"
],
"threshold": 0.9
},
"id": "CVE-2024-57805-50eb8e6b"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/sof/intel/hda-dai.c",
"function": "hda_link_dma_cleanup"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d0ba147d901022bcb69da8d8fd817f84e9f3ca",
"digest": {
"length": 666.0,
"function_hash": "46941135675595135660311335945666230212"
},
"id": "CVE-2024-57805-91d689ca"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/sof/intel/hda-dai.c",
"function": "hda_dai_hw_free"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d0ba147d901022bcb69da8d8fd817f84e9f3ca",
"digest": {
"length": 378.0,
"function_hash": "265446000850863662572387205421222382384"
},
"id": "CVE-2024-57805-9a3a0a37"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"target": {
"file": "sound/soc/sof/intel/hda-dai.c",
"function": "hda_dai_trigger"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8d0ba147d901022bcb69da8d8fd817f84e9f3ca",
"digest": {
"length": 1092.0,
"function_hash": "329938755589604348670179978516212278377"
},
"id": "CVE-2024-57805-e9e8e596"
}
]