CVE-2024-38605

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: core: Fix NULL module pointer assignment at card init

The commit 81033c6b584b ("ALSA: core: Warn on empty module")

introduced a WARN_ON() for a NULL module pointer passed at snd_card

object creation, and it also wraps the code around it with '#ifdef

MODULE'. This works in most cases, but the devils are always in

details. "MODULE" is defined when the target code (i.e. the sound

core) is built as a module; but this doesn't mean that the caller is

also built-in or not. Namely, when only the sound core is built-in

(CONFIG_SND=y) while the driver is a module (CONFIG_SND_USB_AUDIO=m),

the passed module pointer is ignored even if it's non-NULL, and

card->module remains as NULL. This would result in the missing module

reference up/down at the device open/close, leading to a race with the

code execution after the module removal.

For addressing the bug, move the assignment of card->module again out

of ifdef. The WA

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References