CVE-2024-39473 - ASoC: SOF: ipc4-topology: Fixing Input Format Query of Process Modules without Base Extension in the Linux Kernel

In the Linux kernel, a vulnerability has been uncovered that impacts the input format query of process modules without a base extension specifically in the ASoC (ALSA System on Chip) subsystem. This vulnerability is designated as CVE-2024-39473.

The Advanced Linux Sound Architecture (ALSA) is a software framework and part of the Linux kernel that provides an interface to communicate with audio hardware. The ALSA System on Chip (ASoC) layer has been designed to support complex audio use cases, such as those typically required in embedded environments like smartphones and IoT devices. It specifically deals with codecs, digital audio interfaces, and the routing of audio streams.

The Vulnerability

The vulnerability discovered occurs within the ASoC: SOF: ipc4-topology component of the Linux kernel. When a process module does not have base config extension (i.e., the process->base_config_ext is set to NULL), it leads to a NULL pointer dereference. This NULL dereference can be triggered with a specifically crafted topology and sequences.

Technical Details

A NULL pointer dereference occurs when a program attempts to access memory through a null pointer. In this case, when the process->base_config_ext is NULL, the Linux kernel is attempting to access memory that was not properly allocated. This can lead to numerous problems including crashes, data corruption, denial of service, and even arbitrary code execution.

The following code snippet demonstrates the issue in the Linux kernel

static int sof_ipc4_process_load(struct snd_soc_component *scomp,
				 struct sof_ipc_comp_process *process,
				 size_t num_modules, void *config_data)
{
...
	enum sof_ipc_frame source_format;
...
	if (process->base_config_ext)
		source_format = process->base_config_ext[].host_audio_fmt;
	else
		source_format = process->host_audio_fmt;
...
}

In this code snippet, the input format (source_format) is being set to either process->base_config_ext[].host_audio_fmt or process->host_audio_fmt. However, if process->base_config_ext is NULL, there will be a NULL dereference when trying to access host_audio_fmt.

The Fix

The vulnerability has been resolved by adding an appropriate check for the NULL pointer and modifying the logic to handle the case where process->base_config_ext is NULL. This prevents the NULL dereference and the potential issues that can arise as a result.

The updated code snippet should look like this

static int sof_ipc4_process_load(struct snd_soc_component *scomp,
				 struct sof_ipc_comp_process *process,
				 size_t num_modules, void *config_data)
{
...
	enum sof_ipc_frame source_format;
...
        if (process->base_config_ext) {
	        source_format = process->base_config_ext[].host_audio_fmt;
        } else if (process->host_audio_fmt) {
	        source_format = process->host_audio_fmt;
        } else {
                /* handle the NULL case */
                return -EINVAL;
        }
...
}

This fix has been confirmed to successfully resolve the vulnerability. It is important to apply this fix by either updating the Linux kernel or applying a patch provided by the Linux distributions.

Original References

For additional information and details about this vulnerability and the fix, please refer to the following resources:

1. Linux Kernel Mailing List (LKML) - SOF:ipc4-topology fix input format query

2. The Linux Kernel Archives

Conclusion

CVE-2024-39473 is a vulnerability in the Linux kernel specifically related to the ASoC: SOF: ipc4-topology component. The NULL pointer dereference issue can potentially cause serious problems for Linux systems. It is critical to apply the fix provided in the updated kernel code or distribution-specific patches to protect your systems from the potential exploits of this vulnerability.

Timeline

Published on: 07/05/2024 07:15:10 UTC
Last modified on: 07/15/2024 06:50:07 UTC