CVE-2024-46798 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object When using kernel with the following extra config, - CONFIG_KASAN=y - CONFIG_KASAN_GENERIC=y - CONFIG_KASAN_INLINE=y - CONFIG_KASAN_VMALLOC=y - CONFIG_FRAME_WARN=4096 kernel detects that snd_pcm_suspend_all() access a freed 'snd_soc_pcm_runtime' object when the system is suspended, which leads to a use-after-free bug: [ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270 [ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330 [ 52.047785] Call trace: [ 52.047787] dump_backtrace+0x0/0x3c0 [ 52.047794] show_stack+0x34/0x50 [ 52.047797] dump_stack_lvl+0x68/0x8c [ 52.047802] print_address_description.constprop.0+0x74/0x2c0 [ 52.047809] kasan_report+0x210/0x230 [ 52.047815] __asan_report_load1_noabort+0x3c/0x50 [ 52.047820] snd_pcm_suspend_all+0x1a8/0x270 [ 52.047824] snd_soc_suspend+0x19c/0x4e0 The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before making any access. So we need to always set 'substream->runtime' to NULL everytime we kfree() it.
A use-after-free vulnerability has been identified in the Linux kernel's ASoC (ALSA System on Chip) DAPM (Dynamic Audio Power Management) component. This issue arises when the kernel is configured with specific options that enable the Kernel Address Sanitizer (KASAN). Under these conditions, the kernel detects that the function 'snd_pcm_suspend_all()' is accessing a 'snd_soc_pcm_runtime' object that has already been freed. This improper access occurs during system suspension, leading to the use-after-free bug. The vulnerability has been addressed by ensuring that the 'substream->runtime' pointer is set to NULL after the associated memory is freed, preventing any further access to the invalidated object.
Users can upgrade to the latest Linux kernel versions available in their distribution to address this vulnerability. For Debian 11, this means upgrading to version 5.10.226-1. Users currently on Linux 5.10 should continue to use that version, while those on Linux 6.1 can upgrade to version 6.1.119-1~deb11u1.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 29, 2024References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 5.4, < 5.4.284 >= 5.5, < 5.10.226 >= 5.11, < 5.15.167 >= 5.16, < 6.1.110 >= 6.2, < 6.6.51 >= 6.7, < 6.10.10 6.11 rc1 6.11 rc2 6.11 rc3 6.11 rc4 6.11 rc5 6.11 rc6 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 3, 2025 | CVE Modified | CVE |
| Sep 20, 2024 | Initial Analysis | [email protected] |
| Sep 18, 2024 | New CVE Received | kernel.org |