Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-50104
CVE-2024-50104:
Linux Debian vulnerability analysis and mitigation
Overview
A NULL pointer dereference vulnerability was discovered in the Linux kernel's ASoC (ALSA System on Chip) Qualcomm SDM845 sound driver. The issue arose during the migration of Soundwire runtime stream allocation from the Qualcomm Soundwire controller to SoC's soundcard drivers, where the sdm845 soundcard was overlooked. The vulnerability affects Linux kernel versions from 6.8 up to (excluding) 6.11.6, and various release candidates of version 6.12 (NVD).
Technical details
The vulnerability occurs when wsa881xhwparams() is called with stream = NULL and passes it further to sdwstreamaddslave() without proper checks. This results in a NULL pointer dereference when attempting to access the masterlist member in struct sdwstreamruntime at offset 32. The issue manifests during any playback attempt or audio daemon startup on affected systems, particularly on the sdm845-db845c (Qualcomm RB3 board). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 MEDIUM (Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) (NVD, Kernel Patch).
Impact
When exploited, this vulnerability results in a kernel NULL pointer dereference, leading to a system crash (denial of service). This affects systems using the Qualcomm SDM845 sound driver, particularly those with audio playback functionality (NVD).
Mitigation and workarounds
The vulnerability has been fixed by adding required calls to qcomsndsdwstartup() and sdwreleasestream() to startup and shutdown routines. This restores the correct behavior when ->setstream() method is called to set a valid stream runtime pointer on playback startup. Users should update to Linux kernel version 6.11.6 or later, or apply the available patch (Kernel Patch).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management