REDHAT-BUG-2461471: Use After Free
In the Linux kernel, the following vulnerability has been resolved:
ALSA: 6fire: fix use-after-free on disconnect
In usb6firechipabort(), the chip struct is allocated as the card's private data (via sndcardnew with sizeof(struct sfirechip)). When sndcardfreewhenclosed() is called and no file handles are open, the card and embedded chip are freed synchronously. The subsequent chip->card = NULL write then hits freed slab memory.
Call trace: usb6firechipabort sound/usb/6fire/chip.c:59 [inline] usb6firechipdisconnect+0x348/0x358 sound/usb/6fire/chip.c:182 usbunbindinterface+0x1a8/0x88c drivers/usb/core/driver.c:458 ... hubevent+0x1a04/0x4518 drivers/usb/core/hub.c:5953
Fix by moving the card lifecycle out of usb6firechipabort() and into usb6firechipdisconnect(). The card pointer is saved in a local before any teardown, sndcarddisconnect() is called first to prevent new opens, URBs are aborted while chip is still valid, and sndcardfreewhenclosed() is called last so chip is never accessed after the card may be freed.
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2461471?
The severity of REDHAT-BUG-2461471 is medium with a score of 4.
What type of vulnerability is REDHAT-BUG-2461471?
REDHAT-BUG-2461471 is categorized as a Use After Free vulnerability.
How was the vulnerability REDHAT-BUG-2461471 resolved?
The vulnerability REDHAT-BUG-2461471 was resolved by fixing the use-after-free issue in the 6fire ALSA driver.
Which software is affected by REDHAT-BUG-2461471?
REDHAT-BUG-2461471 affects the Linux ALSA 6fire driver within the Linux kernel.
What is the impact of not addressing REDHAT-BUG-2461471?
Not addressing REDHAT-BUG-2461471 may lead to potential denial of service or exploitation through memory corruption.