CVE-2024-39491 (GCVE-0-2024-39491)
Vulnerability from cvelistv5
Published
2024-07-10 07:14
Modified
2025-05-04 09:16
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance The cs_dsp instance is initialized in the driver probe() so it should be freed in the driver remove(). Also fix a missing call to cs_dsp_remove() in the error path of cs35l56_hda_common_probe(). The call to cs_dsp_remove() was being done in the component unbind callback cs35l56_hda_unbind(). This meant that if the driver was unbound and then re-bound it would be using an uninitialized cs_dsp instance. It is best to initialize the cs_dsp instance in probe() so that it can return an error if it fails. The component binding API doesn't have any error handling so there's no way to handle a failure if cs_dsp was initialized in the bind.
Impacted products
Vendor Product Version
Linux Linux Version: 73cfbfa9caea8eda54b4c6e49a9555533660aa1e
Version: 73cfbfa9caea8eda54b4c6e49a9555533660aa1e
Version: 73cfbfa9caea8eda54b4c6e49a9555533660aa1e
Create a notification for this product.
   Linux Linux Version: 6.6
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:26:15.537Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/9054c474f9c219e58a441e401c0e6e38fe713ff1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/60d5e087e5f334475b032ad7e6ad849fb998f303"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d344873c4cbde249b7152d36a273bcc45864001e"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-39491",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:07:32.607472Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:41.041Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/pci/hda/cs35l56_hda.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9054c474f9c219e58a441e401c0e6e38fe713ff1",
              "status": "affected",
              "version": "73cfbfa9caea8eda54b4c6e49a9555533660aa1e",
              "versionType": "git"
            },
            {
              "lessThan": "60d5e087e5f334475b032ad7e6ad849fb998f303",
              "status": "affected",
              "version": "73cfbfa9caea8eda54b4c6e49a9555533660aa1e",
              "versionType": "git"
            },
            {
              "lessThan": "d344873c4cbde249b7152d36a273bcc45864001e",
              "status": "affected",
              "version": "73cfbfa9caea8eda54b4c6e49a9555533660aa1e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/pci/hda/cs35l56_hda.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.4",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda: cs35l56: Fix lifetime of cs_dsp instance\n\nThe cs_dsp instance is initialized in the driver probe() so it\nshould be freed in the driver remove(). Also fix a missing call\nto cs_dsp_remove() in the error path of cs35l56_hda_common_probe().\n\nThe call to cs_dsp_remove() was being done in the component unbind\ncallback cs35l56_hda_unbind(). This meant that if the driver was\nunbound and then re-bound it would be using an uninitialized cs_dsp\ninstance.\n\nIt is best to initialize the cs_dsp instance in probe() so that it\ncan return an error if it fails. The component binding API doesn\u0027t\nhave any error handling so there\u0027s no way to handle a failure if\ncs_dsp was initialized in the bind."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T09:16:55.762Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9054c474f9c219e58a441e401c0e6e38fe713ff1"
        },
        {
          "url": "https://git.kernel.org/stable/c/60d5e087e5f334475b032ad7e6ad849fb998f303"
        },
        {
          "url": "https://git.kernel.org/stable/c/d344873c4cbde249b7152d36a273bcc45864001e"
        }
      ],
      "title": "ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-39491",
    "datePublished": "2024-07-10T07:14:10.314Z",
    "dateReserved": "2024-06-25T14:23:23.748Z",
    "dateUpdated": "2025-05-04T09:16:55.762Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-39491\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-07-10T08:15:11.287\",\"lastModified\":\"2024-11-21T09:27:48.380\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: hda: cs35l56: Fix lifetime of cs_dsp instance\\n\\nThe cs_dsp instance is initialized in the driver probe() so it\\nshould be freed in the driver remove(). Also fix a missing call\\nto cs_dsp_remove() in the error path of cs35l56_hda_common_probe().\\n\\nThe call to cs_dsp_remove() was being done in the component unbind\\ncallback cs35l56_hda_unbind(). This meant that if the driver was\\nunbound and then re-bound it would be using an uninitialized cs_dsp\\ninstance.\\n\\nIt is best to initialize the cs_dsp instance in probe() so that it\\ncan return an error if it fails. The component binding API doesn\u0027t\\nhave any error handling so there\u0027s no way to handle a failure if\\ncs_dsp was initialized in the bind.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: hda: cs35l56: Correcci\u00f3n de duraci\u00f3n de la instancia cs_dsp La instancia cs_dsp se inicializa en el controlador probe() por lo que debe liberarse en el controlador remove(). Tambi\u00e9n corrija una llamada faltante a cs_dsp_remove() en la ruta de error de cs35l56_hda_common_probe(). La llamada a cs_dsp_remove() se realizaba en la devoluci\u00f3n de llamada de desvinculaci\u00f3n del componente cs35l56_hda_unbind(). Esto significaba que si el controlador no estaba vinculado y luego se volv\u00eda a vincular, estar\u00eda utilizando una instancia cs_dsp no inicializada. Es mejor inicializar la instancia cs_dsp en probe() para que pueda devolver un error si falla. La API de enlace de componentes no tiene ning\u00fan control de errores, por lo que no hay forma de controlar un error si cs_dsp se inicializ\u00f3 en el enlace.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/60d5e087e5f334475b032ad7e6ad849fb998f303\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9054c474f9c219e58a441e401c0e6e38fe713ff1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d344873c4cbde249b7152d36a273bcc45864001e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/60d5e087e5f334475b032ad7e6ad849fb998f303\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/9054c474f9c219e58a441e401c0e6e38fe713ff1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://git.kernel.org/stable/c/d344873c4cbde249b7152d36a273bcc45864001e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9054c474f9c219e58a441e401c0e6e38fe713ff1\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/60d5e087e5f334475b032ad7e6ad849fb998f303\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/d344873c4cbde249b7152d36a273bcc45864001e\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:26:15.537Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-39491\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T17:07:32.607472Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:25.186Z\"}}], \"cna\": {\"title\": \"ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"73cfbfa9caea\", \"lessThan\": \"9054c474f9c2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73cfbfa9caea\", \"lessThan\": \"60d5e087e5f3\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"73cfbfa9caea\", \"lessThan\": \"d344873c4cbd\", \"versionType\": \"git\"}], \"programFiles\": [\"sound/pci/hda/cs35l56_hda.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.6\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"6.6\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"sound/pci/hda/cs35l56_hda.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/9054c474f9c219e58a441e401c0e6e38fe713ff1\"}, {\"url\": \"https://git.kernel.org/stable/c/60d5e087e5f334475b032ad7e6ad849fb998f303\"}, {\"url\": \"https://git.kernel.org/stable/c/d344873c4cbde249b7152d36a273bcc45864001e\"}], \"x_generator\": {\"engine\": \"bippy-9e1c9544281a\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: hda: cs35l56: Fix lifetime of cs_dsp instance\\n\\nThe cs_dsp instance is initialized in the driver probe() so it\\nshould be freed in the driver remove(). Also fix a missing call\\nto cs_dsp_remove() in the error path of cs35l56_hda_common_probe().\\n\\nThe call to cs_dsp_remove() was being done in the component unbind\\ncallback cs35l56_hda_unbind(). This meant that if the driver was\\nunbound and then re-bound it would be using an uninitialized cs_dsp\\ninstance.\\n\\nIt is best to initialize the cs_dsp instance in probe() so that it\\ncan return an error if it fails. The component binding API doesn\u0027t\\nhave any error handling so there\u0027s no way to handle a failure if\\ncs_dsp was initialized in the bind.\"}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2024-11-05T09:32:20.667Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-39491\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-11-05T09:32:20.667Z\", \"dateReserved\": \"2024-06-25T14:23:23.748Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-07-10T07:14:10.314Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}