CVE-2024-39491

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-39491
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance The cs_dsp instance is initialized in the driver probe() so it should be freed in the driver remove(). Also fix a missing call to cs_dsp_remove() in the error path of cs35l56_hda_common_probe(). The call to cs_dsp_remove() was being done in the component unbind callback cs35l56_hda_unbind(). This meant that if the driver was unbound and then re-bound it would be using an uninitialized cs_dsp instance. It is best to initialize the cs_dsp instance in probe() so that it can return an error if it fails. The component binding API doesn't have any error handling so there's no way to handle a failure if cs_dsp was initialized in the bind.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/60d5e087e5f334475b032ad7e6ad849fb998f303 Patch
https://git.kernel.org/stable/c/9054c474f9c219e58a441e401c0e6e38fe713ff1 Patch
https://git.kernel.org/stable/c/d344873c4cbde249b7152d36a273bcc45864001e Patch
https://git.kernel.org/stable/c/60d5e087e5f334475b032ad7e6ad849fb998f303 Patch
https://git.kernel.org/stable/c/9054c474f9c219e58a441e401c0e6e38fe713ff1 Patch
https://git.kernel.org/stable/c/d344873c4cbde249b7152d36a273bcc45864001e Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

17 Sep 2025, 16:15

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/60d5e087e5f334475b032ad7e6ad849fb998f303 - () https://git.kernel.org/stable/c/60d5e087e5f334475b032ad7e6ad849fb998f303 - Patch
References () https://git.kernel.org/stable/c/9054c474f9c219e58a441e401c0e6e38fe713ff1 - () https://git.kernel.org/stable/c/9054c474f9c219e58a441e401c0e6e38fe713ff1 - Patch
References () https://git.kernel.org/stable/c/d344873c4cbde249b7152d36a273bcc45864001e - () https://git.kernel.org/stable/c/d344873c4cbde249b7152d36a273bcc45864001e - Patch
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-908

21 Nov 2024, 09:27

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/60d5e087e5f334475b032ad7e6ad849fb998f303 - () https://git.kernel.org/stable/c/60d5e087e5f334475b032ad7e6ad849fb998f303 -
References () https://git.kernel.org/stable/c/9054c474f9c219e58a441e401c0e6e38fe713ff1 - () https://git.kernel.org/stable/c/9054c474f9c219e58a441e401c0e6e38fe713ff1 -
References () https://git.kernel.org/stable/c/d344873c4cbde249b7152d36a273bcc45864001e - () https://git.kernel.org/stable/c/d344873c4cbde249b7152d36a273bcc45864001e -

11 Jul 2024, 13:05

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: hda: cs35l56: Corrección de duración de la instancia cs_dsp La instancia cs_dsp se inicializa en el controlador probe() por lo que debe liberarse en el controlador remove(). También corrija una llamada faltante a cs_dsp_remove() en la ruta de error de cs35l56_hda_common_probe(). La llamada a cs_dsp_remove() se realizaba en la devolución de llamada de desvinculación del componente cs35l56_hda_unbind(). Esto significaba que si el controlador no estaba vinculado y luego se volvía a vincular, estaría utilizando una instancia cs_dsp no inicializada. Es mejor inicializar la instancia cs_dsp en probe() para que pueda devolver un error si falla. La API de enlace de componentes no tiene ningún control de errores, por lo que no hay forma de controlar un error si cs_dsp se inicializó en el enlace.

10 Jul 2024, 08:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-10 08:15

Updated : 2025-09-17 16:15

NVD link : CVE-2024-39491

Mitre link : CVE-2024-39491

CVE.ORG link : CVE-2024-39491

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-908

Use of Uninitialized Resource