CVE-2023-54022: ALSA: usb-audio: Fix potential memory leaks at error path for UMP open
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix potential memory leaks at error path for UMP open
The allocation and initialization errors at allocmidiurbs() that is called at MIDI 2.0 / UMP device are supposed to be handled at the caller side by invoking freemidiurbs(). However, freemidiurbs() loops only for ep->numurbs entries, and since ep->numentries wasn't updated yet at the allocation / init error in allocmidiurbs(), this entry won't be released.
The intention of freemidiurbs() is to release the whole elements, so change the loop size to NUMURBS to scan over all elements for fixing the missed releases.
Also, the call of freemidiurbs() is missing at sndusbmidiv2open(). Although it'll be released later at reopen/close or disconnection, it's better to release immediately at the error path.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-54022?
CVE-2023-54022 has been classified with a severity level indicating it involves potential memory leaks.
How do I fix CVE-2023-54022?
To fix CVE-2023-54022, ensure your Linux kernel is updated to the latest stable version that includes the patch.
What systems are affected by CVE-2023-54022?
CVE-2023-54022 affects the ALSA usb-audio subsystem within the Linux kernel.
What are the potential impacts of CVE-2023-54022?
The potential impacts of CVE-2023-54022 primarily include memory leaks that could affect system performance.
When was CVE-2023-54022 disclosed?
CVE-2023-54022 was disclosed in 2023 as part of the ongoing security improvements for the Linux kernel.