In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: caiaq: unregister the input device when probe fails<\/p>\n
setup_card() registers the input device, whose name and phys point into
\nstruct snd_usb_caiaqdev, and then goes on to snd_card_register() and
\nsnd_usb_caiaq_control_init(). If either fails, snd_probe() calls
\nsnd_card_free(), which frees the device state but leaves the input
\ndevice registered: card_free() only clears the pointer, and the input
\ndevice is unregistered from snd_disconnect() alone. Reading its “uevent”
\nattribute afterwards dereferences freed memory:<\/p>\n
BUG: KASAN: slab-use-after-free in string+0x4a9\/0x4f0
\n Read of size 1 at addr ffff8880208f5043 by task caiaq\/4967
\n add_uevent_var+0x183\/0x3a0
\n input_dev_uevent+0x162\/0x900
\n dev_uevent+0x2f1\/0x870
\n uevent_show+0x1ca\/0x3a0
\n …<\/p>\n
Unregister the input device on the probe error path, as
\nsnd_disconnect() does. snd_usb_caiaq_input_disconnect() is a no-op when
\nno input device was registered.<\/p>\n
Reproduced with a raw-gadget Audio Kontrol 1 and a temporary hack that
\nmakes snd_usb_caiaq_control_init() fail.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: caiaq: unregister the input device when probe fails<\/p>\n
setup_card() registers the input device, whose name and phys point into<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41309","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41309","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41309"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41309"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41309"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}