CVE-2024-58077: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
In the Linux kernel, the following vulnerability has been resolved:
ASoC: soc-pcm: don't use socpcmret() on .prepare callback
commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common socpcmret(). It is used from many functions, ignoring -EINVAL is over-kill.
The reason why -EINVAL was ignored was it really should only be used upon invalid parameters coming from userspace and in that case we don't want to log an error since we do not want to give userspace a way to do a denial-of-service attack on the syslog / diskspace.
So don't use socpcmret() on .prepare callback is better idea.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch commit 1f5664351410 - Configuration
In ASoC soc-pcm, avoid calling soc_pcm_ret() from the .prepare callback as a resolved mitigation, since ignoring -EINVAL there can lead to undesirable logging/behavior described in the fix.
Linux kernel ASoC (soc-pcm) soc_pcm_ret() usage = Do not use soc_pcm_ret() on the .prepare callback
Event History
Frequently Asked Questions
What is the severity of CVE-2024-58077?
CVE-2024-58077 has not been assigned a CVSS score, but it addresses an issue in the Linux kernel related to the handling of error messages.
How do I fix CVE-2024-58077?
To fix CVE-2024-58077, update the Linux kernel to a patched version that resolves the ASoC: soc-pcm vulnerability.
Which versions of the Linux kernel are affected by CVE-2024-58077?
CVE-2024-58077 affects multiple versions of the Linux kernel, but specifics depend on individual distributions and their update practices.
What component of the Linux kernel is impacted by CVE-2024-58077?
CVE-2024-58077 impacts the ASoC (ALSA System on Chip) subsystem, specifically the soc-pcm code handling.
Is CVE-2024-58077 an exploitable vulnerability?
While CVE-2024-58077 may expose systems to certain conditions, its exploitability would depend on the specific configurations and use cases in the affected environments.