CVE-2024-26799CWE-824

CVE-2024-26799

High · published April 4, 2024

CVSS v3.1
7.0
EPSS
0%
Percentile
14.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ASoC: qcom: Fix uninitialized pointer dmactl

In the case where __lpass_get_dmactl_handle is called and the driver

id dai_id is invalid the pointer dmactl is not being assigned a value,

and dmactl contains a garbage value since it has not been initialized

and so the null check may not work. Fix this to initialize dmactl to

NULL. One could argue that modern compilers will set this to zero, but

it is useful to keep this initialized as per the same way in functions

__lpass_platform_codec_intf_init and lpass_cdc_dma_daiops_hw_params.

Cleans up clang scan build warning:

sound/soc/qcom/lpass-cdc-dma.c:275:7: warning: Branch condition

evaluates to a garbage value [core.uninitialized.Branch]

The record
Technical detail
CVSS v3.1
7.0 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00241 · 14.3th percentile
Weakness
CWE-824 · Access of Uninitialized Pointer
Published
2024-04-04T13:15Z
Affected products (8)
ProductVersionsFixed in
linux/linux_kernel≥ 5.18, < 6.6.216.6.21
linux/linux_kernel≥ 6.7, < 6.7.96.7.9
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (6)
EPSS history
Timeline
  • 04 APR 08:20Z
    ASoC: qcom: Fix uninitialized pointer dmactl
    cvelistv5