CVE-2024-35842: ASoC: mediatek: sof-common: Add NULL check for normal_link string
In the Linux kernel, the following vulnerability has been resolved:
ASoC: mediatek: sof-common: Add NULL check for normallink string
It's not granted that all entries of struct sofconnstream declare a normallink (a non-SOF, direct link) string, and this is the case for SoCs that support only SOF paths (hence do not support both direct and SOF usecases).
For example, in the case of MT8188 there is no normallink string in any of the sofconnstream entries and there will be more drivers doing that in the future.
To avoid possible NULL pointer KPs, add a NULL check for normallink.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Compensating control
Add a NULL check for the `normal_link` string in `ASoC: mediatek: sof-common` to avoid possible NULL pointer KPs when `sof_conn_stream` entries omit `normal_link`.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-35842?
CVE-2024-35842 has a medium severity level due to potential security implications in the Linux kernel.
How do I fix CVE-2024-35842?
To resolve CVE-2024-35842, upgrade your Linux kernel to one of the fixed versions such as 5.10.223-1, 6.1.119-1, or later.
Which versions of the Linux kernel are affected by CVE-2024-35842?
CVE-2024-35842 affects various versions of the Linux kernel prior to the patches in 5.10.223-1 and 6.1.119-1.
What components are impacted by CVE-2024-35842?
CVE-2024-35842 impacts the ASoC (ALSA System on Chip) subsystem in the Linux kernel.
Is CVE-2024-35842 specific to certain hardware?
CVE-2024-35842 is related to specific SoCs (System on Chips) that utilize the ASoC framework in the Linux kernel.