CVE-2024-50292

ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove

Medium · published November 19, 2024

CVSS v3.1
5.5
EPSS
0%
Percentile
13.0
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove

In case of error when requesting ctrl_chan DMA channel, ctrl_chan is not

null. So the release of the dma channel leads to the following issue:

[ 4.879000] st,stm32-spdifrx 500d0000.audio-controller:

dma_request_slave_channel error -19

[ 4.888975] Unable to handle kernel NULL pointer dereference

at virtual address 000000000000003d

[...]

[ 5.096577] Call trace:

[ 5.099099] dma_release_channel+0x24/0x100

[ 5.103235] stm32_spdifrx_remove+0x24/0x60 [snd_soc_stm32_spdifrx]

[ 5.109494] stm32_spdifrx_probe+0x320/0x4c4 [snd_soc_stm32_spdifrx]

To avoid this issue, release channel only if the pointer is valid.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00229 · 13.0th percentile
Published
2024-11-19T01:30Z
EPSS history
Timeline
  • 19 NOV 01:30Z
    ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove
    cvelistv5