We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Assigner | Linux |
Reserved | 2024-06-20 |
Published | 2024-06-20 |
Updated | 2024-09-11 |
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix UAF of leds class devs at unbinding The LED class devices that are created by HD-audio codec drivers are registered via devm_led_classdev_register() and associated with the HD-audio codec device. Unfortunately, it turned out that the devres release doesn't work for this case; namely, since the codec resource release happens before the devm call chain, it triggers a NULL dereference or a UAF for a stale set_brightness_delay callback. For fixing the bug, this patch changes the LED class device register and unregister in a manual manner without devres, keeping the instances in hda_gen_spec.
https://git.kernel.org/stable/c/a7de1002135cf94367748ffc695a29812d7633b5
https://git.kernel.org/stable/c/0e629052f013eeb61494d4df2f1f647c2a9aef47
https://git.kernel.org/stable/c/813e9f3e06d22e29872d4fd51b54992d89cf66c8
https://git.kernel.org/stable/c/549f8ffc7b2f7561bea7f90930b6c5104318e87b