CVE-2024-39491: ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda: cs35l56: Fix lifetime of csdsp instance
The csdsp instance is initialized in the driver probe() so it should be freed in the driver remove(). Also fix a missing call to csdspremove() in the error path of cs35l56hdacommonprobe().
The call to csdspremove() was being done in the component unbind callback cs35l56hdaunbind(). This meant that if the driver was unbound and then re-bound it would be using an uninitialized csdsp instance.
It is best to initialize the csdsp instance in probe() so that it can return an error if it fails. The component binding API doesn't have any error handling so there's no way to handle a failure if csdsp was initialized in the bind.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda: cs35l56: Fix lifetime of csdsp instance
The Linux kernel CVE team has assigned CVE-2024-39491 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024071016-CVE-2024-39491-fb62@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39491?
CVE-2024-39491 has a high severity level due to its impact on the Linux kernel's audio subsystem.
How do I fix CVE-2024-39491?
To fix CVE-2024-39491, update to the latest kernel versions specified in the affected software section such as 6.6.33 or 6.10.
Which software versions are affected by CVE-2024-39491?
CVE-2024-39491 affects multiple versions of the Linux kernel, including 5.10.223-1, 5.10.226-1, 6.1.123-1, and others.
Who is responsible for fixing CVE-2024-39491?
Fixing CVE-2024-39491 is the responsibility of the maintainers of the affected Linux kernel packages.
What components are impacted by CVE-2024-39491?
CVE-2024-39491 specifically impacts the ALSA hda and cs35l56 components in the Linux kernel.