In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: core: Fix use-after-free in snd_card_do_free()<\/p>\n
A use-after-free was detected in snd_card_do_free() when a sound card
\nmanaged by devres is unbound while a user-space application still holds an
\nopen file descriptor.<\/p>\n
For managed cards, the memory is allocated using devres_alloc(), and its
\nrelease function is set to __snd_card_release(), which calls
\nsnd_card_free(). When the device is unbound, the unbind thread calls
\nsnd_card_free(), which drops a reference to the card’s device. If the user
\nthread still has an open file descriptor, the reference count does not
\nreach zero, and the unbind thread blocks on wait_for_completion(&released).<\/p>\n
When the user thread closes the file descriptor, it drops the final
\nreference, invoking the device release callback release_card_device(),
\nwhich calls snd_card_do_free(). snd_card_do_free() performs cleanup and
\ncalls complete(card->release_completion). This wakes up the unbind thread,
\nwhich returns from snd_card_free() and __snd_card_release(). The devres
\ncore then immediately frees the memory block containing the snd_card
\nstructure.<\/p>\n
Meanwhile, the user thread continues execution in snd_card_do_free() and
\nevaluates `if (!card->managed)`. It reads the `managed` boolean from the
\nsnd_card structure that was just freed by the unbind thread, triggering a
\nKASAN use-after-free.<\/p>\n
Fix this by caching the value of card->managed in a local variable before
\ncalling complete(). This ensures that the card pointer is not dereferenced
\nafter the unbind thread has been woken up and potentially freed the card.<\/p>\n
BUG: KASAN: use-after-free in snd_card_do_free sound\/core\/init.c:604
\n[inline]
\nBUG: KASAN: use-after-free in release_card_device+0x1ab\/0x1b0
\nsound\/core\/init.c:153
\nRead of size 1 at addr ffff8881912ec909 by task syz-executor130\/5857<\/p>\n
Call Trace:<\/p>\n
dump_stack_lvl+0xe8\/0x150 lib\/dump_stack.c:120
\n print_address_description+0x55\/0x1e0 mm\/kasan\/report.c:378
\n print_report+0x58\/0x70 mm\/kasan\/report.c:482
\n kasan_report+0x117\/0x150 mm\/kasan\/report.c:595
\n snd_card_do_free sound\/core\/init.c:604 [inline]
\n release_card_device+0x1ab\/0x1b0 sound\/core\/init.c:153
\n device_release+0xc4\/0x1f0 drivers\/base\/core.c:-1
\n kobject_cleanup lib\/kobject.c:689 [inline]
\n kobject_release lib\/kobject.c:720 [inline]
\n kref_put include\/linux\/kref.h:65 [inline]
\n kobject_put+0x222\/0x550 lib\/kobject.c:737
\n snd_card_file_remove+0x331\/0x390 sound\/core\/init.c:1125
\n snd_pcm_release+0x12c\/0x160 sound\/core\/pcm_native.c:2986
\n __fput+0x418\/0xa50 fs\/file_table.c:512
\n fput_close_sync+0x11f\/0x240 fs\/file_table.c:617
\n __do_sys_close fs\/open.c:1511 [inline]
\n __se_sys_close fs\/open.c:1496 [inline]
\n __x64_sys_close+0x7e\/0x110 fs\/open.c:1496
\n do_syscall_x64 arch\/x86\/entry\/syscall_64.c:63 [inline]
\n do_syscall_64+0x174\/0x580 arch\/x86\/entry\/syscall_64.c:94
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: core: Fix use-after-free in snd_card_do_free()<\/p>\n
A use-after-free was detected in snd_card_do_free() when a sound card
\nmanaged<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25607","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25607","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25607"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25607"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25607"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}