CVE-2024-38605 (GCVE-0-2024-38605)

Vulnerability from cvelistv5 – Published: 2024-06-19 13:48 – Updated: 2026-05-11 20:19
VLAI?
Title
ALSA: core: Fix NULL module pointer assignment at card init
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix NULL module pointer assignment at card init The commit 81033c6b584b ("ALSA: core: Warn on empty module") introduced a WARN_ON() for a NULL module pointer passed at snd_card object creation, and it also wraps the code around it with '#ifdef MODULE'. This works in most cases, but the devils are always in details. "MODULE" is defined when the target code (i.e. the sound core) is built as a module; but this doesn't mean that the caller is also built-in or not. Namely, when only the sound core is built-in (CONFIG_SND=y) while the driver is a module (CONFIG_SND_USB_AUDIO=m), the passed module pointer is ignored even if it's non-NULL, and card->module remains as NULL. This would result in the missing module reference up/down at the device open/close, leading to a race with the code execution after the module removal. For addressing the bug, move the assignment of card->module again out of ifdef. The WARN_ON() is still wrapped with ifdef because the module can be really NULL when all sound drivers are built-in. Note that we keep 'ifdef MODULE' for WARN_ON(), otherwise it would lead to a false-positive NULL module check. Admittedly it won't catch perfectly, i.e. no check is performed when CONFIG_SND=y. But, it's no real problem as it's only for debugging, and the condition is pretty rare.
Severity ?
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 81033c6b584b44514cbb16fffc26ca29a0fa6270 , < d7ff29a429b56f04783152ad7bbd7233b740e434 (git)
Affected: 81033c6b584b44514cbb16fffc26ca29a0fa6270 , < e7e0ca200772bdb2fdc6d43d32d341e87a36f811 (git)
Affected: 81033c6b584b44514cbb16fffc26ca29a0fa6270 , < e007476725730c1a68387b54b7629486d8a8301e (git)
Affected: 81033c6b584b44514cbb16fffc26ca29a0fa6270 , < e644036a3e2b2c9b3eee3c61b5d31c2ca8b5ba92 (git)
Affected: 81033c6b584b44514cbb16fffc26ca29a0fa6270 , < c935e72139e6d523defd60fe875c01eb1f9ea5c5 (git)
Affected: 81033c6b584b44514cbb16fffc26ca29a0fa6270 , < 6b8374ee2cabcf034faa34e69a855dc496a9ec12 (git)
Affected: 81033c6b584b44514cbb16fffc26ca29a0fa6270 , < 39381fe7394e5eafac76e7e9367e7351138a29c1 (git)
Create a notification for this product.
Linux Linux Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 5.10.219 , ≤ 5.10.* (semver)
Unaffected: 5.15.161 , ≤ 5.15.* (semver)
Unaffected: 6.1.93 , ≤ 6.1.* (semver)
Unaffected: 6.6.33 , ≤ 6.6.* (semver)
Unaffected: 6.8.12 , ≤ 6.8.* (semver)
Unaffected: 6.9.3 , ≤ 6.9.* (semver)
Unaffected: 6.10 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "d7ff29a429b5",
                "status": "affected",
                "version": "81033c6b584b",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "e7e0ca200772",
                "status": "affected",
                "version": "81033c6b584b",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "e00747672573",
                "status": "affected",
                "version": "81033c6b584b",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "e644036a3e2b",
                "status": "affected",
                "version": "81033c6b584b",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "c935e72139e6",
                "status": "affected",
                "version": "81033c6b584b",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "6b8374ee2cab",
                "status": "affected",
                "version": "81033c6b584b",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "39381fe7394e",
                "status": "affected",
                "version": "81033c6b584b",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "affected",
                "version": "5.9"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThan": "5.9",
                "status": "unaffected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.11",
                "status": "unaffected",
                "version": "5.10.219",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "5.16",
                "status": "unaffected",
                "version": "5.15.161",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "6.2",
                "status": "unaffected",
                "version": "6.1.93",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "6.7",
                "status": "unaffected",
                "version": "6.6.33",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "6.9",
                "status": "unaffected",
                "version": "6.8.12",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "lessThanOrEqual": "6.7",
                "status": "unaffected",
                "version": "6.9.3",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "linux_kernel",
            "vendor": "linux",
            "versions": [
              {
                "status": "unaffected",
                "version": "6.10-rc1"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-38605",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-27T17:45:58.997847Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-27T18:08:30.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T04:12:25.960Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/d7ff29a429b56f04783152ad7bbd7233b740e434"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e7e0ca200772bdb2fdc6d43d32d341e87a36f811"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e007476725730c1a68387b54b7629486d8a8301e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/e644036a3e2b2c9b3eee3c61b5d31c2ca8b5ba92"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/c935e72139e6d523defd60fe875c01eb1f9ea5c5"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/6b8374ee2cabcf034faa34e69a855dc496a9ec12"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/39381fe7394e5eafac76e7e9367e7351138a29c1"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/core/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d7ff29a429b56f04783152ad7bbd7233b740e434",
              "status": "affected",
              "version": "81033c6b584b44514cbb16fffc26ca29a0fa6270",
              "versionType": "git"
            },
            {
              "lessThan": "e7e0ca200772bdb2fdc6d43d32d341e87a36f811",
              "status": "affected",
              "version": "81033c6b584b44514cbb16fffc26ca29a0fa6270",
              "versionType": "git"
            },
            {
              "lessThan": "e007476725730c1a68387b54b7629486d8a8301e",
              "status": "affected",
              "version": "81033c6b584b44514cbb16fffc26ca29a0fa6270",
              "versionType": "git"
            },
            {
              "lessThan": "e644036a3e2b2c9b3eee3c61b5d31c2ca8b5ba92",
              "status": "affected",
              "version": "81033c6b584b44514cbb16fffc26ca29a0fa6270",
              "versionType": "git"
            },
            {
              "lessThan": "c935e72139e6d523defd60fe875c01eb1f9ea5c5",
              "status": "affected",
              "version": "81033c6b584b44514cbb16fffc26ca29a0fa6270",
              "versionType": "git"
            },
            {
              "lessThan": "6b8374ee2cabcf034faa34e69a855dc496a9ec12",
              "status": "affected",
              "version": "81033c6b584b44514cbb16fffc26ca29a0fa6270",
              "versionType": "git"
            },
            {
              "lessThan": "39381fe7394e5eafac76e7e9367e7351138a29c1",
              "status": "affected",
              "version": "81033c6b584b44514cbb16fffc26ca29a0fa6270",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/core/init.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.219",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.161",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.9.*",
              "status": "unaffected",
              "version": "6.9.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.10",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.219",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.161",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.93",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.33",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8.12",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.9.3",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: core: Fix NULL module pointer assignment at card init\n\nThe commit 81033c6b584b (\"ALSA: core: Warn on empty module\")\nintroduced a WARN_ON() for a NULL module pointer passed at snd_card\nobject creation, and it also wraps the code around it with \u0027#ifdef\nMODULE\u0027.  This works in most cases, but the devils are always in\ndetails.  \"MODULE\" is defined when the target code (i.e. the sound\ncore) is built as a module; but this doesn\u0027t mean that the caller is\nalso built-in or not.  Namely, when only the sound core is built-in\n(CONFIG_SND=y) while the driver is a module (CONFIG_SND_USB_AUDIO=m),\nthe passed module pointer is ignored even if it\u0027s non-NULL, and\ncard-\u003emodule remains as NULL.  This would result in the missing module\nreference up/down at the device open/close, leading to a race with the\ncode execution after the module removal.\n\nFor addressing the bug, move the assignment of card-\u003emodule again out\nof ifdef.  The WARN_ON() is still wrapped with ifdef because the\nmodule can be really NULL when all sound drivers are built-in.\n\nNote that we keep \u0027ifdef MODULE\u0027 for WARN_ON(), otherwise it would\nlead to a false-positive NULL module check.  Admittedly it won\u0027t catch\nperfectly, i.e. no check is performed when CONFIG_SND=y.  But, it\u0027s no\nreal problem as it\u0027s only for debugging, and the condition is pretty\nrare."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:19:57.427Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d7ff29a429b56f04783152ad7bbd7233b740e434"
        },
        {
          "url": "https://git.kernel.org/stable/c/e7e0ca200772bdb2fdc6d43d32d341e87a36f811"
        },
        {
          "url": "https://git.kernel.org/stable/c/e007476725730c1a68387b54b7629486d8a8301e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e644036a3e2b2c9b3eee3c61b5d31c2ca8b5ba92"
        },
        {
          "url": "https://git.kernel.org/stable/c/c935e72139e6d523defd60fe875c01eb1f9ea5c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/6b8374ee2cabcf034faa34e69a855dc496a9ec12"
        },
        {
          "url": "https://git.kernel.org/stable/c/39381fe7394e5eafac76e7e9367e7351138a29c1"
        }
      ],
      "title": "ALSA: core: Fix NULL module pointer assignment at card init",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-38605",
    "datePublished": "2024-06-19T13:48:15.769Z",
    "dateReserved": "2024-06-18T19:36:34.934Z",
    "dateUpdated": "2026-05-11T20:19:57.427Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-38605",
      "date": "2026-05-21",
      "epss": "0.00178",
      "percentile": "0.38987"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: core: Fix NULL module pointer assignment at card init\\n\\nThe commit 81033c6b584b (\\\"ALSA: core: Warn on empty module\\\")\\nintroduced a WARN_ON() for a NULL module pointer passed at snd_card\\nobject creation, and it also wraps the code around it with \u0027#ifdef\\nMODULE\u0027.  This works in most cases, but the devils are always in\\ndetails.  \\\"MODULE\\\" is defined when the target code (i.e. the sound\\ncore) is built as a module; but this doesn\u0027t mean that the caller is\\nalso built-in or not.  Namely, when only the sound core is built-in\\n(CONFIG_SND=y) while the driver is a module (CONFIG_SND_USB_AUDIO=m),\\nthe passed module pointer is ignored even if it\u0027s non-NULL, and\\ncard-\u003emodule remains as NULL.  This would result in the missing module\\nreference up/down at the device open/close, leading to a race with the\\ncode execution after the module removal.\\n\\nFor addressing the bug, move the assignment of card-\u003emodule again out\\nof ifdef.  The WARN_ON() is still wrapped with ifdef because the\\nmodule can be really NULL when all sound drivers are built-in.\\n\\nNote that we keep \u0027ifdef MODULE\u0027 for WARN_ON(), otherwise it would\\nlead to a false-positive NULL module check.  Admittedly it won\u0027t catch\\nperfectly, i.e. no check is performed when CONFIG_SND=y.  But, it\u0027s no\\nreal problem as it\u0027s only for debugging, and the condition is pretty\\nrare.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: n\\u00facleo: corrige la asignaci\\u00f3n del puntero del m\\u00f3dulo NULL en el inicio de la tarjeta el commit 81033c6b584b (\\\"ALSA: n\\u00facleo: Advertencia sobre m\\u00f3dulo vac\\u00edo\\\") introdujo un WARN_ON() para un puntero de m\\u00f3dulo NULL pasado en la creaci\\u00f3n del objeto snd_card, y tambi\\u00e9n envuelve el c\\u00f3digo a su alrededor con \u0027#ifdef MODULE\u0027. Esto funciona en la mayor\\u00eda de los casos, pero los problemas siempre est\\u00e1n en los detalles. \\\"M\\u00d3DULO\\\" se define cuando el c\\u00f3digo objetivo (es decir, el n\\u00facleo de sonido) se construye como un m\\u00f3dulo; pero esto no significa que la persona que llama tambi\\u00e9n est\\u00e9 integrada o no. Es decir, cuando solo el n\\u00facleo de sonido est\\u00e1 integrado (CONFIG_SND=y) mientras el controlador es un m\\u00f3dulo (CONFIG_SND_USB_AUDIO=m), el puntero del m\\u00f3dulo pasado se ignora incluso si no es NULL, y tarjeta-\u0026gt;m\\u00f3dulo permanece como NULL. Esto dar\\u00eda como resultado que la referencia del m\\u00f3dulo faltante suba o baje en la apertura o cierre del dispositivo, lo que provocar\\u00eda una ejecuci\\u00f3n con la ejecuci\\u00f3n del c\\u00f3digo despu\\u00e9s de la eliminaci\\u00f3n del m\\u00f3dulo. Para solucionar el error, mueva la asignaci\\u00f3n de tarjeta-\u0026gt;m\\u00f3dulo nuevamente fuera de ifdef. WARN_ON() todav\\u00eda est\\u00e1 incluido en ifdef porque el m\\u00f3dulo puede ser realmente NULL cuando todos los controladores de sonido est\\u00e1n integrados. Tenga en cuenta que mantenemos \u0027ifdef MODULE\u0027 para WARN_ON(); de lo contrario, se producir\\u00eda una verificaci\\u00f3n de m\\u00f3dulo NULL falsamente positiva. Es cierto que no se detectar\\u00e1 perfectamente, es decir, no se realiza ninguna verificaci\\u00f3n cuando CONFIG_SND=y. Pero no es un problema real ya que es solo para depurar y la condici\\u00f3n es bastante rara.\"}]",
      "id": "CVE-2024-38605",
      "lastModified": "2024-11-21T09:26:27.937",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
      "published": "2024-06-19T14:15:20.443",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/39381fe7394e5eafac76e7e9367e7351138a29c1\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/6b8374ee2cabcf034faa34e69a855dc496a9ec12\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/c935e72139e6d523defd60fe875c01eb1f9ea5c5\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/d7ff29a429b56f04783152ad7bbd7233b740e434\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e007476725730c1a68387b54b7629486d8a8301e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e644036a3e2b2c9b3eee3c61b5d31c2ca8b5ba92\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/e7e0ca200772bdb2fdc6d43d32d341e87a36f811\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}, {\"url\": \"https://git.kernel.org/stable/c/39381fe7394e5eafac76e7e9367e7351138a29c1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/6b8374ee2cabcf034faa34e69a855dc496a9ec12\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/c935e72139e6d523defd60fe875c01eb1f9ea5c5\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/d7ff29a429b56f04783152ad7bbd7233b740e434\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e007476725730c1a68387b54b7629486d8a8301e\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e644036a3e2b2c9b3eee3c61b5d31c2ca8b5ba92\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://git.kernel.org/stable/c/e7e0ca200772bdb2fdc6d43d32d341e87a36f811\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-476\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-38605\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-06-19T14:15:20.443\",\"lastModified\":\"2025-04-01T18:26:12.557\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: core: Fix NULL module pointer assignment at card init\\n\\nThe commit 81033c6b584b (\\\"ALSA: core: Warn on empty module\\\")\\nintroduced a WARN_ON() for a NULL module pointer passed at snd_card\\nobject creation, and it also wraps the code around it with \u0027#ifdef\\nMODULE\u0027.  This works in most cases, but the devils are always in\\ndetails.  \\\"MODULE\\\" is defined when the target code (i.e. the sound\\ncore) is built as a module; but this doesn\u0027t mean that the caller is\\nalso built-in or not.  Namely, when only the sound core is built-in\\n(CONFIG_SND=y) while the driver is a module (CONFIG_SND_USB_AUDIO=m),\\nthe passed module pointer is ignored even if it\u0027s non-NULL, and\\ncard-\u003emodule remains as NULL.  This would result in the missing module\\nreference up/down at the device open/close, leading to a race with the\\ncode execution after the module removal.\\n\\nFor addressing the bug, move the assignment of card-\u003emodule again out\\nof ifdef.  The WARN_ON() is still wrapped with ifdef because the\\nmodule can be really NULL when all sound drivers are built-in.\\n\\nNote that we keep \u0027ifdef MODULE\u0027 for WARN_ON(), otherwise it would\\nlead to a false-positive NULL module check.  Admittedly it won\u0027t catch\\nperfectly, i.e. no check is performed when CONFIG_SND=y.  But, it\u0027s no\\nreal problem as it\u0027s only for debugging, and the condition is pretty\\nrare.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: n\u00facleo: corrige la asignaci\u00f3n del puntero del m\u00f3dulo NULL en el inicio de la tarjeta el commit 81033c6b584b (\\\"ALSA: n\u00facleo: Advertencia sobre m\u00f3dulo vac\u00edo\\\") introdujo un WARN_ON() para un puntero de m\u00f3dulo NULL pasado en la creaci\u00f3n del objeto snd_card, y tambi\u00e9n envuelve el c\u00f3digo a su alrededor con \u0027#ifdef MODULE\u0027. Esto funciona en la mayor\u00eda de los casos, pero los problemas siempre est\u00e1n en los detalles. \\\"M\u00d3DULO\\\" se define cuando el c\u00f3digo objetivo (es decir, el n\u00facleo de sonido) se construye como un m\u00f3dulo; pero esto no significa que la persona que llama tambi\u00e9n est\u00e9 integrada o no. Es decir, cuando solo el n\u00facleo de sonido est\u00e1 integrado (CONFIG_SND=y) mientras el controlador es un m\u00f3dulo (CONFIG_SND_USB_AUDIO=m), el puntero del m\u00f3dulo pasado se ignora incluso si no es NULL, y tarjeta-\u0026gt;m\u00f3dulo permanece como NULL. Esto dar\u00eda como resultado que la referencia del m\u00f3dulo faltante suba o baje en la apertura o cierre del dispositivo, lo que provocar\u00eda una ejecuci\u00f3n con la ejecuci\u00f3n del c\u00f3digo despu\u00e9s de la eliminaci\u00f3n del m\u00f3dulo. Para solucionar el error, mueva la asignaci\u00f3n de tarjeta-\u0026gt;m\u00f3dulo nuevamente fuera de ifdef. WARN_ON() todav\u00eda est\u00e1 incluido en ifdef porque el m\u00f3dulo puede ser realmente NULL cuando todos los controladores de sonido est\u00e1n integrados. Tenga en cuenta que mantenemos \u0027ifdef MODULE\u0027 para WARN_ON(); de lo contrario, se producir\u00eda una verificaci\u00f3n de m\u00f3dulo NULL falsamente positiva. Es cierto que no se detectar\u00e1 perfectamente, es decir, no se realiza ninguna verificaci\u00f3n cuando CONFIG_SND=y. Pero no es un problema real ya que es solo para depurar y la condici\u00f3n es bastante rara.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.9\",\"versionEndExcluding\":\"5.10.219\",\"matchCriteriaId\":\"581A5C93-812B-417F-9FAD-5A963507C367\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.161\",\"matchCriteriaId\":\"31130639-53FE-4726-8986-434EE2528CB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.93\",\"matchCriteriaId\":\"EEFB78EE-F990-4197-BF1C-156760A55667\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.33\",\"matchCriteriaId\":\"FCE796DF-3B50-4DC6-BAE5-95271068FC9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.8.12\",\"matchCriteriaId\":\"80550309-67AB-4FD1-AC07-3DED5C4F01B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.9\",\"versionEndExcluding\":\"6.9.3\",\"matchCriteriaId\":\"E07124C1-19E8-4D21-828D-9932A01D3011\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/39381fe7394e5eafac76e7e9367e7351138a29c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6b8374ee2cabcf034faa34e69a855dc496a9ec12\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c935e72139e6d523defd60fe875c01eb1f9ea5c5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d7ff29a429b56f04783152ad7bbd7233b740e434\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e007476725730c1a68387b54b7629486d8a8301e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e644036a3e2b2c9b3eee3c61b5d31c2ca8b5ba92\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e7e0ca200772bdb2fdc6d43d32d341e87a36f811\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/39381fe7394e5eafac76e7e9367e7351138a29c1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6b8374ee2cabcf034faa34e69a855dc496a9ec12\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c935e72139e6d523defd60fe875c01eb1f9ea5c5\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d7ff29a429b56f04783152ad7bbd7233b740e434\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e007476725730c1a68387b54b7629486d8a8301e\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e644036a3e2b2c9b3eee3c61b5d31c2ca8b5ba92\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e7e0ca200772bdb2fdc6d43d32d341e87a36f811\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d7ff29a429b56f04783152ad7bbd7233b740e434\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e7e0ca200772bdb2fdc6d43d32d341e87a36f811\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e007476725730c1a68387b54b7629486d8a8301e\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/e644036a3e2b2c9b3eee3c61b5d31c2ca8b5ba92\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/c935e72139e6d523defd60fe875c01eb1f9ea5c5\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/6b8374ee2cabcf034faa34e69a855dc496a9ec12\", \"tags\": [\"x_transferred\"]}, {\"url\": \"https://git.kernel.org/stable/c/39381fe7394e5eafac76e7e9367e7351138a29c1\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T04:12:25.960Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-38605\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-27T17:45:58.997847Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"81033c6b584b\", \"lessThan\": \"d7ff29a429b5\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"81033c6b584b\", \"lessThan\": \"e7e0ca200772\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"81033c6b584b\", \"lessThan\": \"e00747672573\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"81033c6b584b\", \"lessThan\": \"e644036a3e2b\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"81033c6b584b\", \"lessThan\": \"c935e72139e6\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"81033c6b584b\", \"lessThan\": \"6b8374ee2cab\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"81033c6b584b\", \"lessThan\": \"39381fe7394e\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.9\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.9\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.10.219\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.11\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"5.15.161\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"5.16\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.2\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.7\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.9\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"6.7\"}], \"defaultStatus\": \"unknown\"}, {\"cpes\": [\"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*\"], \"vendor\": \"linux\", \"product\": \"linux_kernel\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6.10-rc1\"}], \"defaultStatus\": \"unknown\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-27T17:49:16.979Z\"}}], \"cna\": {\"title\": \"ALSA: core: Fix NULL module pointer assignment at card init\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"81033c6b584b44514cbb16fffc26ca29a0fa6270\", \"lessThan\": \"d7ff29a429b56f04783152ad7bbd7233b740e434\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"81033c6b584b44514cbb16fffc26ca29a0fa6270\", \"lessThan\": \"e7e0ca200772bdb2fdc6d43d32d341e87a36f811\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"81033c6b584b44514cbb16fffc26ca29a0fa6270\", \"lessThan\": \"e007476725730c1a68387b54b7629486d8a8301e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"81033c6b584b44514cbb16fffc26ca29a0fa6270\", \"lessThan\": \"e644036a3e2b2c9b3eee3c61b5d31c2ca8b5ba92\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"81033c6b584b44514cbb16fffc26ca29a0fa6270\", \"lessThan\": \"c935e72139e6d523defd60fe875c01eb1f9ea5c5\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"81033c6b584b44514cbb16fffc26ca29a0fa6270\", \"lessThan\": \"6b8374ee2cabcf034faa34e69a855dc496a9ec12\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"81033c6b584b44514cbb16fffc26ca29a0fa6270\", \"lessThan\": \"39381fe7394e5eafac76e7e9367e7351138a29c1\", \"versionType\": \"git\"}], \"programFiles\": [\"sound/core/init.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.9\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.9\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.219\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.161\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.93\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.33\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.8.12\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.8.*\"}, {\"status\": \"unaffected\", \"version\": \"6.9.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.9.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"sound/core/init.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/d7ff29a429b56f04783152ad7bbd7233b740e434\"}, {\"url\": \"https://git.kernel.org/stable/c/e7e0ca200772bdb2fdc6d43d32d341e87a36f811\"}, {\"url\": \"https://git.kernel.org/stable/c/e007476725730c1a68387b54b7629486d8a8301e\"}, {\"url\": \"https://git.kernel.org/stable/c/e644036a3e2b2c9b3eee3c61b5d31c2ca8b5ba92\"}, {\"url\": \"https://git.kernel.org/stable/c/c935e72139e6d523defd60fe875c01eb1f9ea5c5\"}, {\"url\": \"https://git.kernel.org/stable/c/6b8374ee2cabcf034faa34e69a855dc496a9ec12\"}, {\"url\": \"https://git.kernel.org/stable/c/39381fe7394e5eafac76e7e9367e7351138a29c1\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: core: Fix NULL module pointer assignment at card init\\n\\nThe commit 81033c6b584b (\\\"ALSA: core: Warn on empty module\\\")\\nintroduced a WARN_ON() for a NULL module pointer passed at snd_card\\nobject creation, and it also wraps the code around it with \u0027#ifdef\\nMODULE\u0027.  This works in most cases, but the devils are always in\\ndetails.  \\\"MODULE\\\" is defined when the target code (i.e. the sound\\ncore) is built as a module; but this doesn\u0027t mean that the caller is\\nalso built-in or not.  Namely, when only the sound core is built-in\\n(CONFIG_SND=y) while the driver is a module (CONFIG_SND_USB_AUDIO=m),\\nthe passed module pointer is ignored even if it\u0027s non-NULL, and\\ncard-\u003emodule remains as NULL.  This would result in the missing module\\nreference up/down at the device open/close, leading to a race with the\\ncode execution after the module removal.\\n\\nFor addressing the bug, move the assignment of card-\u003emodule again out\\nof ifdef.  The WARN_ON() is still wrapped with ifdef because the\\nmodule can be really NULL when all sound drivers are built-in.\\n\\nNote that we keep \u0027ifdef MODULE\u0027 for WARN_ON(), otherwise it would\\nlead to a false-positive NULL module check.  Admittedly it won\u0027t catch\\nperfectly, i.e. no check is performed when CONFIG_SND=y.  But, it\u0027s no\\nreal problem as it\u0027s only for debugging, and the condition is pretty\\nrare.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.219\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.161\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.93\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.33\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.8.12\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.9.3\", \"versionStartIncluding\": \"5.9\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10\", \"versionStartIncluding\": \"5.9\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:15:07.886Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-38605\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:15:07.886Z\", \"dateReserved\": \"2024-06-18T19:36:34.934Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-06-19T13:48:15.769Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.