CVE-2024-50292: linux kernel vulnerability

What is known

In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: spdifrx: fix dma channel release in stm32_spdifrx_remove In case of error when requesting ctrl_chan DMA channel, ctrl_chan is not null. So the release of the dma channel leads to the following issue: [ 4.879000] st,stm32-spdifrx 500d0000.audio-controller: dma_request_slave_channel error -19 [ 4.888975] Unable to handle kernel NULL pointer dereference at virtual address 000000000000003d [...] [ 5.096577] Call trace: [ 5.099099] dma_release_channel+0x24/0x100 [ 5.103235] stm32_spdifrx_remove+0x24/0x60 [snd_soc_stm32_spdifrx] [ 5.109494] stm32_spdifrx_probe+0x320/0x4c4 [snd_soc_stm32_spdifrx] To avoid this issue, release channel only if the pointer is valid.

Business impact

Successful exploitation of CVE-2024-50292, a medium vulnerability (CVSS 5.5) affecting linux kernel, may affect the confidentiality, integrity or availability of the vulnerable environment. The exact impact depends on the installed version, exposed interfaces and deployment configuration.

Recommended administrator action

Confirm whether linux kernel is present and compare installed versions with the vendor advisory and NVD record. Apply the vendor patch or documented mitigation; until remediation is complete, reduce exposure of affected interfaces, review relevant logs and monitor for indicators of exploitation. DataHouse can support version verification, managed patching, network exposure reduction, log review and backup validation for dedicated, cloud and colocated environments.

Sources

• NVD
• Reference
• Reference
• Reference
• Reference
• Reference
• Reference
• Reference
• Reference