github - ghsa-crxp-pw8g-fqxp

ghsa-crxp-pw8g-fqxp

Vulnerability from github

Published

2024-11-07 12:30

Modified

2024-11-13 18:31

Severity ?

5.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Details

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda/cs8409: Fix possible NULL dereference

If snd_hda_gen_add_kctl fails to allocate memory and returns NULL, then NULL pointer dereference will occur in the next line.

Since dolphin_fixups function is a hda_fixup function which is not supposed to return any errors, add simple check before dereference, ignore the fail.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-50160"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-476"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-11-07T10:15:07Z",
    "severity": "MODERATE"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda/cs8409: Fix possible NULL dereference\n\nIf snd_hda_gen_add_kctl fails to allocate memory and returns NULL, then\nNULL pointer dereference will occur in the next line.\n\nSince dolphin_fixups function is a hda_fixup function which is not supposed\nto return any errors, add simple check before dereference, ignore the fail.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE.",
  "id": "GHSA-crxp-pw8g-fqxp",
  "modified": "2024-11-13T18:31:52Z",
  "published": "2024-11-07T12:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50160"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/21dc97d5086fdabbe278786bb0a03cbf2e26c793"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4e19aca8db696b6ba4dd8c73657405e15c695f14"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8971fd61210d75fd2af225621cd2fcc87eb1847c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a5dd71a8b849626f42d08a5e73d382f2016fc7bc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c9bd4a82b4ed32c6d1c90500a52063e6e341517f"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

cve-2024-50160

Vulnerability from cvelistv5

Published

2024-11-07 09:31

Modified

2024-12-19 09:34

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs8409: Fix possible NULL dereference If snd_hda_gen_add_kctl fails to allocate memory and returns NULL, then NULL pointer dereference will occur in the next line. Since dolphin_fixups function is a hda_fixup function which is not supposed to return any errors, add simple check before dereference, ignore the fail. Found by Linux Verification Center (linuxtesting.org) with SVACE.

References

▼	URL	Tags
	https://git.kernel.org/stable/c/4e19aca8db696b6ba4dd8c73657405e15c695f14
	https://git.kernel.org/stable/c/21dc97d5086fdabbe278786bb0a03cbf2e26c793
	https://git.kernel.org/stable/c/8971fd61210d75fd2af225621cd2fcc87eb1847c
	https://git.kernel.org/stable/c/a5dd71a8b849626f42d08a5e73d382f2016fc7bc
	https://git.kernel.org/stable/c/c9bd4a82b4ed32c6d1c90500a52063e6e341517f

Impacted products

Vendor

Product

Version

▼

Linux

Version: 20e507724113300794f16884e7e7507d9b4dec68
Version: 20e507724113300794f16884e7e7507d9b4dec68
Version: 20e507724113300794f16884e7e7507d9b4dec68
Version: 20e507724113300794f16884e7e7507d9b4dec68
Version: 20e507724113300794f16884e7e7507d9b4dec68

Linux

Version: 5.15

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/pci/hda/patch_cs8409.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4e19aca8db696b6ba4dd8c73657405e15c695f14",
              "status": "affected",
              "version": "20e507724113300794f16884e7e7507d9b4dec68",
              "versionType": "git"
            },
            {
              "lessThan": "21dc97d5086fdabbe278786bb0a03cbf2e26c793",
              "status": "affected",
              "version": "20e507724113300794f16884e7e7507d9b4dec68",
              "versionType": "git"
            },
            {
              "lessThan": "8971fd61210d75fd2af225621cd2fcc87eb1847c",
              "status": "affected",
              "version": "20e507724113300794f16884e7e7507d9b4dec68",
              "versionType": "git"
            },
            {
              "lessThan": "a5dd71a8b849626f42d08a5e73d382f2016fc7bc",
              "status": "affected",
              "version": "20e507724113300794f16884e7e7507d9b4dec68",
              "versionType": "git"
            },
            {
              "lessThan": "c9bd4a82b4ed32c6d1c90500a52063e6e341517f",
              "status": "affected",
              "version": "20e507724113300794f16884e7e7507d9b4dec68",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/pci/hda/patch_cs8409.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.170",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.115",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.59",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: hda/cs8409: Fix possible NULL dereference\n\nIf snd_hda_gen_add_kctl fails to allocate memory and returns NULL, then\nNULL pointer dereference will occur in the next line.\n\nSince dolphin_fixups function is a hda_fixup function which is not supposed\nto return any errors, add simple check before dereference, ignore the fail.\n\nFound by Linux Verification Center (linuxtesting.org) with SVACE."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-19T09:34:23.122Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4e19aca8db696b6ba4dd8c73657405e15c695f14"
        },
        {
          "url": "https://git.kernel.org/stable/c/21dc97d5086fdabbe278786bb0a03cbf2e26c793"
        },
        {
          "url": "https://git.kernel.org/stable/c/8971fd61210d75fd2af225621cd2fcc87eb1847c"
        },
        {
          "url": "https://git.kernel.org/stable/c/a5dd71a8b849626f42d08a5e73d382f2016fc7bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9bd4a82b4ed32c6d1c90500a52063e6e341517f"
        }
      ],
      "title": "ALSA: hda/cs8409: Fix possible NULL dereference",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50160",
    "datePublished": "2024-11-07T09:31:37.095Z",
    "dateReserved": "2024-10-21T19:36:19.961Z",
    "dateUpdated": "2024-12-19T09:34:23.122Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted