In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: gadget: u_audio: Fix use-after-free on sound card disconnect<\/p>\n
g_audio_cleanup() invokes snd_card_free_when_closed() to initiate sound
\ncard teardown and immediately frees the underlying struct snd_uac_chip
\ncontext. However, snd_card_free_when_closed() returns asynchronously
\nwhile ALSA control elements (kctls) remain open in userspace.<\/p>\n
When userspace control applications access or close these open file
\ndescriptors, kctl callbacks attempt to dereference kctl->private_data
\npointing to &uac->c_prm or &uac->p_prm within the freed uac structure,
\nresulting in a use-after-free (UAF) memory corruption.<\/p>\n
Fix this issue by deferring the destruction of struct snd_uac_chip until
\nall references to the ALSA sound card are released. Register a custom
\ncard->private_free callback (u_audio_card_free) during g_audio_setup()
\nthat frees uac and its associated playback\/capture request and ring
\nbuffers only when the sound card reference count drops to zero.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: gadget: u_audio: Fix use-after-free on sound card disconnect<\/p>\n
g_audio_cleanup() invokes snd_card_free_when_closed() to initiat<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21658","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21658","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}