CVE-2024-38550: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-38550 is a vulnerability discovered in the Linux kernel's ASoC (ALSA System on Chip) Kirkwood driver. The issue was identified by the Linux Verification Center (linuxtesting.org) using SVACE analysis tool and was disclosed on June 19, 2024. The vulnerability affects the kirkwood_dma_hw_params() function in the Kirkwood audio driver, where a potential NULL pointer dereference could occur when the CONFIG_PLAT_ORION macro is not defined (Ubuntu).

The vulnerability exists in the kirkwood_dma_hw_params() function where mv_mbus_dram_info() can return NULL if the CONFIG_PLAT_ORION macro is not defined. Without proper NULL pointer checking, this could lead to a dereference of the NULL pointer. The issue was fixed by adding a NULL check before using the dram pointer returned by mv_mbus_dram_info(). The CVSS v3.1 score for this vulnerability is 4.4 (MEDIUM) with a vector string of CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H (NIST NVD).

If exploited, this vulnerability could lead to a system crash through a NULL pointer dereference, resulting in a denial of service condition. The impact is limited to systems where the CONFIG_PLAT_ORION macro is not defined and the Kirkwood audio driver is in use (NIST NVD).

The vulnerability requires local access with high privileges to exploit. There are no known reports of this vulnerability being exploited in the wild (NIST NVD).

The vulnerability has been fixed in various Linux kernel versions. Ubuntu has released patches for affected versions: Ubuntu 24.04 LTS (noble) - linux 6.8.0-40.40, Ubuntu 22.04 LTS (jammy) - linux 5.15.0-121.131, and other supported versions. Users are advised to update their systems to the patched versions (Ubuntu).