[<prev] [next>] [day] [month] [year] [list]
Message-ID: <2024122721-CVE-2024-56531-6a91@gregkh>
Date: Fri, 27 Dec 2024 15:11:22 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-56531: ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
The USB disconnect callback is supposed to be short and not too-long
waiting. OTOH, the current code uses snd_card_free() at
disconnection, but this waits for the close of all used fds, hence it
can take long. It eventually blocks the upper layer USB ioctls, which
may trigger a soft lockup.
An easy workaround is to replace snd_card_free() with
snd_card_free_when_closed(). This variant returns immediately while
the release of resources is done asynchronously by the card device
release at the last close.
This patch also splits the code to the disconnect and the free phases;
the former is called immediately at the USB disconnect callback while
the latter is called from the card destructor.
The Linux kernel CVE team has assigned CVE-2024-56531 to this issue.
Affected and fixed versions
===========================
Issue introduced in 2.6.22 with commit 523f1dce37434a9a6623bf46e7893e2b4b10ac3c and fixed in 4.19.325 with commit 3993edf44d3df7b6e8c753eac6ac8783473fcbab
Issue introduced in 2.6.22 with commit 523f1dce37434a9a6623bf46e7893e2b4b10ac3c and fixed in 5.4.287 with commit ebad462eec93b0f701dfe4de98990e7355283801
Issue introduced in 2.6.22 with commit 523f1dce37434a9a6623bf46e7893e2b4b10ac3c and fixed in 5.10.231 with commit 4dd821dcbfcecf7af6a08370b0b217cde2818acf
Issue introduced in 2.6.22 with commit 523f1dce37434a9a6623bf46e7893e2b4b10ac3c and fixed in 5.15.174 with commit cadf1d8e9ddcd74584ec961aeac14ac549b261d8
Issue introduced in 2.6.22 with commit 523f1dce37434a9a6623bf46e7893e2b4b10ac3c and fixed in 6.1.120 with commit 237f3faf0177bdde728fa3106d730d806436aa4d
Issue introduced in 2.6.22 with commit 523f1dce37434a9a6623bf46e7893e2b4b10ac3c and fixed in 6.6.64 with commit 4507a8b9b30344c5ddd8219945f446d47e966a6d
Issue introduced in 2.6.22 with commit 523f1dce37434a9a6623bf46e7893e2b4b10ac3c and fixed in 6.11.11 with commit dd0de8cb708951cebf727aa045e8242ba651bb52
Issue introduced in 2.6.22 with commit 523f1dce37434a9a6623bf46e7893e2b4b10ac3c and fixed in 6.12.2 with commit a3f9314752dbb6f6aa1f0f2b4c58243bda800738
Issue introduced in 2.6.22 with commit 523f1dce37434a9a6623bf46e7893e2b4b10ac3c and fixed in 6.13-rc1 with commit b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2024-56531
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
sound/usb/caiaq/audio.c
sound/usb/caiaq/audio.h
sound/usb/caiaq/device.c
sound/usb/caiaq/input.c
sound/usb/caiaq/input.h
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/3993edf44d3df7b6e8c753eac6ac8783473fcbab
https://git.kernel.org/stable/c/ebad462eec93b0f701dfe4de98990e7355283801
https://git.kernel.org/stable/c/4dd821dcbfcecf7af6a08370b0b217cde2818acf
https://git.kernel.org/stable/c/cadf1d8e9ddcd74584ec961aeac14ac549b261d8
https://git.kernel.org/stable/c/237f3faf0177bdde728fa3106d730d806436aa4d
https://git.kernel.org/stable/c/4507a8b9b30344c5ddd8219945f446d47e966a6d
https://git.kernel.org/stable/c/dd0de8cb708951cebf727aa045e8242ba651bb52
https://git.kernel.org/stable/c/a3f9314752dbb6f6aa1f0f2b4c58243bda800738
https://git.kernel.org/stable/c/b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c
Powered by blists - more mailing lists