CVE-2024-50105 ASoC: qcom: sc7280: Fix missing Soundwire runtime stream alloc
A missing runtime allocation in the Qualcomm SC7280 audio driver causes a null pointer dereference, leading to system crashes during sound playback.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-50105?
CVE-2024-50105 is a medium-severity vulnerability in Linux kernel, published on 5 Nov 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: qcom: sc7280: Fix missing Soundwire runtime stream alloc
Commit 15c7fab0e047 ("ASoC: qcom: Move Soundwire runtime stream alloc to soundcards") moved the allocation of Soundwire stream runtime from the Qualcomm Soundwire driver to each individual machine sound card driver, except that it forgot to update SC7280 card.
Just like for other Qualcomm sound cards using Soundwire, the card driver should allocate and release the runtime. Otherwise sound playback will result in a NULL pointer dereference or other effect of uninitialized memory accesses (which was confirmed on SDM845 having similar issue).
Weakness: CWE-476
Which versions are affected by CVE-2024-50105?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2024-50105?
Apply the vendor's patch.
Is CVE-2024-50105 being exploited?
There is no known exploitation of CVE-2024-50105 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2024-50105, DEBIAN-CVE-2024-50105, GHSA-fjw7-947f-3xx6, UBUNTU-CVE-2024-50105.