cve-2024-56685
Vulnerability from cvelistv5
Published
2024-12-28 09:46
Modified
2025-01-20 06:26
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: Check num_codecs is not zero to avoid panic during probe Following commit 13f58267cda3 ("ASoC: soc.h: don't create dummy Component via COMP_DUMMY()"), COMP_DUMMY() became an array with zero length, and only gets populated with the dummy struct after the card is registered. Since the sound card driver's probe happens before the card registration, accessing any of the members of a dummy component during probe will result in undefined behavior. This can be observed in the mt8188 and mt8195 machine sound drivers. By omitting a dai link subnode in the sound card's node in the Devicetree, the default uninitialized dummy codec is used, and when its dai_name pointer gets passed to strcmp() it results in a null pointer dereference and a kernel panic. In addition to that, set_card_codec_info() in the generic helpers file, mtk-soundcard-driver.c, will populate a dai link with a dummy codec when a dai link node is present in DT but with no codec property. The result is that at probe time, a dummy codec can either be uninitialized with num_codecs = 0, or be an initialized dummy codec, with num_codecs = 1 and dai_name = "snd-soc-dummy-dai". In order to accommodate for both situations, check that num_codecs is not zero before accessing the codecs' fields but still check for the codec's dai name against "snd-soc-dummy-dai" as needed. While at it, also drop the check that dai_name is not null in the mt8192 driver, introduced in commit 4d4e1b6319e5 ("ASoC: mediatek: mt8192: Check existence of dai_name before dereferencing"), as it is actually redundant given the preceding num_codecs != 0 check.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2f2020327cc8561d7c520d2f2d9acea84fa7b3a3
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/376f4800f34a28def026ff5c5d4fc5e54e1744ff
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/550279449ff54c5aa28cfca5c567308cbfb145f0
Impacted products
Vendor Product Version
Linux Linux Version: 13f58267cda3d6946c8f4de368ad5d4a003baa61
Version: 13f58267cda3d6946c8f4de368ad5d4a003baa61
Version: 13f58267cda3d6946c8f4de368ad5d4a003baa61
 Create a notification for this product.
   Linux Linux Version: 6.8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/mediatek/mt8188/mt8188-mt6359.c",
            "sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c",
            "sound/soc/mediatek/mt8195/mt8195-mt6359.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "376f4800f34a28def026ff5c5d4fc5e54e1744ff",
              "status": "affected",
              "version": "13f58267cda3d6946c8f4de368ad5d4a003baa61",
              "versionType": "git"
            },
            {
              "lessThan": "550279449ff54c5aa28cfca5c567308cbfb145f0",
              "status": "affected",
              "version": "13f58267cda3d6946c8f4de368ad5d4a003baa61",
              "versionType": "git"
            },
            {
              "lessThan": "2f2020327cc8561d7c520d2f2d9acea84fa7b3a3",
              "status": "affected",
              "version": "13f58267cda3d6946c8f4de368ad5d4a003baa61",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/mediatek/mt8188/mt8188-mt6359.c",
            "sound/soc/mediatek/mt8192/mt8192-mt6359-rt1015-rt5682.c",
            "sound/soc/mediatek/mt8195/mt8195-mt6359.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.8"
            },
            {
              "lessThan": "6.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: mediatek: Check num_codecs is not zero to avoid panic during probe\n\nFollowing commit 13f58267cda3 (\"ASoC: soc.h: don\u0027t create dummy\nComponent via COMP_DUMMY()\"), COMP_DUMMY() became an array with zero\nlength, and only gets populated with the dummy struct after the card is\nregistered. Since the sound card driver\u0027s probe happens before the card\nregistration, accessing any of the members of a dummy component during\nprobe will result in undefined behavior.\n\nThis can be observed in the mt8188 and mt8195 machine sound drivers. By\nomitting a dai link subnode in the sound card\u0027s node in the Devicetree,\nthe default uninitialized dummy codec is used, and when its dai_name\npointer gets passed to strcmp() it results in a null pointer dereference\nand a kernel panic.\n\nIn addition to that, set_card_codec_info() in the generic helpers file,\nmtk-soundcard-driver.c, will populate a dai link with a dummy codec when\na dai link node is present in DT but with no codec property.\n\nThe result is that at probe time, a dummy codec can either be\nuninitialized with num_codecs = 0, or be an initialized dummy codec,\nwith num_codecs = 1 and dai_name = \"snd-soc-dummy-dai\". In order to\naccommodate for both situations, check that num_codecs is not zero\nbefore accessing the codecs\u0027 fields but still check for the codec\u0027s dai\nname against \"snd-soc-dummy-dai\" as needed.\n\nWhile at it, also drop the check that dai_name is not null in the mt8192\ndriver, introduced in commit 4d4e1b6319e5 (\"ASoC: mediatek: mt8192:\nCheck existence of dai_name before dereferencing\"), as it is actually\nredundant given the preceding num_codecs != 0 check."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-20T06:26:06.887Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/376f4800f34a28def026ff5c5d4fc5e54e1744ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/550279449ff54c5aa28cfca5c567308cbfb145f0"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f2020327cc8561d7c520d2f2d9acea84fa7b3a3"
        }
      ],
      "title": "ASoC: mediatek: Check num_codecs is not zero to avoid panic during probe",
      "x_generator": {
        "engine": "bippy-5f407fcff5a0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56685",
    "datePublished": "2024-12-28T09:46:12.686Z",
    "dateReserved": "2024-12-27T15:00:39.846Z",
    "dateUpdated": "2025-01-20T06:26:06.887Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-56685\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-12-28T10:15:11.593\",\"lastModified\":\"2024-12-28T10:15:11.593\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nASoC: mediatek: Check num_codecs is not zero to avoid panic during probe\\n\\nFollowing commit 13f58267cda3 (\\\"ASoC: soc.h: don\u0027t create dummy\\nComponent via COMP_DUMMY()\\\"), COMP_DUMMY() became an array with zero\\nlength, and only gets populated with the dummy struct after the card is\\nregistered. Since the sound card driver\u0027s probe happens before the card\\nregistration, accessing any of the members of a dummy component during\\nprobe will result in undefined behavior.\\n\\nThis can be observed in the mt8188 and mt8195 machine sound drivers. By\\nomitting a dai link subnode in the sound card\u0027s node in the Devicetree,\\nthe default uninitialized dummy codec is used, and when its dai_name\\npointer gets passed to strcmp() it results in a null pointer dereference\\nand a kernel panic.\\n\\nIn addition to that, set_card_codec_info() in the generic helpers file,\\nmtk-soundcard-driver.c, will populate a dai link with a dummy codec when\\na dai link node is present in DT but with no codec property.\\n\\nThe result is that at probe time, a dummy codec can either be\\nuninitialized with num_codecs = 0, or be an initialized dummy codec,\\nwith num_codecs = 1 and dai_name = \\\"snd-soc-dummy-dai\\\". In order to\\naccommodate for both situations, check that num_codecs is not zero\\nbefore accessing the codecs\u0027 fields but still check for the codec\u0027s dai\\nname against \\\"snd-soc-dummy-dai\\\" as needed.\\n\\nWhile at it, also drop the check that dai_name is not null in the mt8192\\ndriver, introduced in commit 4d4e1b6319e5 (\\\"ASoC: mediatek: mt8192:\\nCheck existence of dai_name before dereferencing\\\"), as it is actually\\nredundant given the preceding num_codecs != 0 check.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2f2020327cc8561d7c520d2f2d9acea84fa7b3a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/376f4800f34a28def026ff5c5d4fc5e54e1744ff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/550279449ff54c5aa28cfca5c567308cbfb145f0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.