CVE-2024-38388: ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/csdspctl: Use privatefree for control cleanup
The Linux kernel CVE team has assigned CVE-2024-38388 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024062137-CVE-2024-38388-fb75@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/csdspctl: Use privatefree for control cleanup
Use the control privatefree callback to free the associated data block. This ensures that the memory won't leak, whatever way the control gets destroyed.
The original implementation didn't actually remove the ALSA controls in hdacsdspcontrolremove(). It only freed the internal tracking structure. This meant it was possible to remove/unload the amp driver while leaving its ALSA controls still present in the soundcard. Obviously attempting to access them could cause segfaults or at least dereferencing stale pointers.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.93 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.33 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.4 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2024-38388
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38388?
CVE-2024-38388 has been categorized as a low severity vulnerability in the Linux kernel.
How do I fix CVE-2024-38388?
To fix CVE-2024-38388, update your kernel to version 6.1.93 or later for Red Hat or to the specified versions for Debian.
Which versions of the Linux kernel are affected by CVE-2024-38388?
CVE-2024-38388 affects various versions of the Linux kernel, including those below 6.1.93, 6.6.33, 6.9.4, and 6.10 for Red Hat, as well as specific versions for Debian.
Is CVE-2024-38388 being actively exploited?
There have been no reported active exploits for CVE-2024-38388 at this time.
What systems are most at risk from CVE-2024-38388?
Systems running vulnerable versions of the Linux kernel, particularly those using ALSA controls, are most at risk for CVE-2024-38388.