CVE-2024-46798 (GCVE-0-2024-46798)

Vulnerability from cvelistv5 – Published: 2024-09-18 07:12 – Updated: 2026-08-05 11:38
VLAI
Title
ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object When using kernel with the following extra config, - CONFIG_KASAN=y - CONFIG_KASAN_GENERIC=y - CONFIG_KASAN_INLINE=y - CONFIG_KASAN_VMALLOC=y - CONFIG_FRAME_WARN=4096 kernel detects that snd_pcm_suspend_all() access a freed 'snd_soc_pcm_runtime' object when the system is suspended, which leads to a use-after-free bug: [ 52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270 [ 52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330 [ 52.047785] Call trace: [ 52.047787] dump_backtrace+0x0/0x3c0 [ 52.047794] show_stack+0x34/0x50 [ 52.047797] dump_stack_lvl+0x68/0x8c [ 52.047802] print_address_description.constprop.0+0x74/0x2c0 [ 52.047809] kasan_report+0x210/0x230 [ 52.047815] __asan_report_load1_noabort+0x3c/0x50 [ 52.047820] snd_pcm_suspend_all+0x1a8/0x270 [ 52.047824] snd_soc_suspend+0x19c/0x4e0 The snd_pcm_sync_stop() has a NULL check on 'substream->runtime' before making any access. So we need to always set 'substream->runtime' to NULL everytime we kfree() it.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 , < 993b60c7f93fa1d8ff296b58f646a867e945ae89 (git)
Affected: a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 , < 8ca21e7a27c66b95a4b215edc8e45e5d66679f9f (git)
Affected: a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 , < 3033ed903b4f28b5e1ab66042084fbc2c48f8624 (git)
Affected: a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 , < fe5046ca91d631ec432eee3bdb1f1c49b09c8b5e (git)
Affected: a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 , < 5d13afd021eb43868fe03cef6da34ad08831ad6d (git)
Affected: a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 , < 6a14fad8be178df6c4589667efec1789a3307b4e (git)
Affected: a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0 , < b4a90b543d9f62d3ac34ec1ab97fc5334b048565 (git)
Create a notification for this product.
Linux Linux Affected: 5.4
Unaffected: 0 , < 5.4 (semver)
Unaffected: 5.4.284 , ≤ 5.4.* (semver)
Unaffected: 5.10.226 , ≤ 5.10.* (semver)
Unaffected: 5.15.167 , ≤ 5.15.* (semver)
Unaffected: 6.1.110 , ≤ 6.1.* (semver)
Unaffected: 6.6.51 , ≤ 6.6.* (semver)
Unaffected: 6.10.10 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-46798",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T14:22:12.387041Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T14:22:24.202Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:18:40.111Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          },
          {
            "url": "https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/soc-dapm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "993b60c7f93fa1d8ff296b58f646a867e945ae89",
              "status": "affected",
              "version": "a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0",
              "versionType": "git"
            },
            {
              "lessThan": "8ca21e7a27c66b95a4b215edc8e45e5d66679f9f",
              "status": "affected",
              "version": "a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0",
              "versionType": "git"
            },
            {
              "lessThan": "3033ed903b4f28b5e1ab66042084fbc2c48f8624",
              "status": "affected",
              "version": "a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0",
              "versionType": "git"
            },
            {
              "lessThan": "fe5046ca91d631ec432eee3bdb1f1c49b09c8b5e",
              "status": "affected",
              "version": "a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0",
              "versionType": "git"
            },
            {
              "lessThan": "5d13afd021eb43868fe03cef6da34ad08831ad6d",
              "status": "affected",
              "version": "a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0",
              "versionType": "git"
            },
            {
              "lessThan": "6a14fad8be178df6c4589667efec1789a3307b4e",
              "status": "affected",
              "version": "a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0",
              "versionType": "git"
            },
            {
              "lessThan": "b4a90b543d9f62d3ac34ec1ab97fc5334b048565",
              "status": "affected",
              "version": "a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/soc/soc-dapm.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.284",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.226",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.284",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.226",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.167",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.110",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.51",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.10",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: dapm: Fix UAF for snd_soc_pcm_runtime object\n\nWhen using kernel with the following extra config,\n\n  - CONFIG_KASAN=y\n  - CONFIG_KASAN_GENERIC=y\n  - CONFIG_KASAN_INLINE=y\n  - CONFIG_KASAN_VMALLOC=y\n  - CONFIG_FRAME_WARN=4096\n\nkernel detects that snd_pcm_suspend_all() access a freed\n\u0027snd_soc_pcm_runtime\u0027 object when the system is suspended, which\nleads to a use-after-free bug:\n\n[   52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270\n[   52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330\n\n[   52.047785] Call trace:\n[   52.047787]  dump_backtrace+0x0/0x3c0\n[   52.047794]  show_stack+0x34/0x50\n[   52.047797]  dump_stack_lvl+0x68/0x8c\n[   52.047802]  print_address_description.constprop.0+0x74/0x2c0\n[   52.047809]  kasan_report+0x210/0x230\n[   52.047815]  __asan_report_load1_noabort+0x3c/0x50\n[   52.047820]  snd_pcm_suspend_all+0x1a8/0x270\n[   52.047824]  snd_soc_suspend+0x19c/0x4e0\n\nThe snd_pcm_sync_stop() has a NULL check on \u0027substream-\u003eruntime\u0027 before\nmaking any access. So we need to always set \u0027substream-\u003eruntime\u0027 to NULL\neverytime we kfree() it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is in the ALSA SoC DAPM layer and is reached through local interfaces \u2014 ALSA control/PCM device nodes (/dev/snd/*) that power the codec2codec DAI-link widget up and down, and a local system-suspend request. There is no network-facing input path.\nAC:L - The stale pointer is left deterministically on every POST_PMD power-down and persists indefinitely; there is no race and no unpredictable state, and the attacker drives both the free (stream/route toggle) and the use (suspend) at will.\nPR:L - An unprivileged local user with normal audio access (audio group or session ACL on /dev/snd/controlC0, as granted to any logged-in user on desktops, phones and embedded systems) can power-cycle the DAPM route and request suspend; no root or CAP_* capability is needed.\nUI:N - The attacker performs every step themselves \u2014 the DAPM power-down that frees the object and the suspend that dereferences it (via logind on an active session, or simply waiting for the automatic suspend that phones, laptops and embedded targets perform routinely). No separate victim action is required.\nS:U - The use-after-free occurs in kernel memory and its impact is confined to the same kernel security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:H - The freed struct snd_pcm_runtime comes from a generic kmalloc cache and can be reclaimed by attacker-sprayed data, and the resulting corruption of a groomed victim object (e.g. clearing a length/offset/flag byte) can be leveraged into out-of-bounds kernel memory disclosure.\nI:H - snd_pcm_sync_stop() not only reads but conditionally writes to the freed object (substream-\u003eruntime-\u003estop_operating = false), giving a controlled one-byte zeroing write at a fixed offset inside an attacker-reclaimed heap object \u2014 a real corruption primitive usable for privilege escalation.\nA:H - The use-after-free reliably corrupts or reads freed slab memory during system suspend, producing kernel oops/panic (immediately fatal under KASAN or panic_on_oops) and rendering the system unavailable."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T11:38:37.461Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/993b60c7f93fa1d8ff296b58f646a867e945ae89"
        },
        {
          "url": "https://git.kernel.org/stable/c/8ca21e7a27c66b95a4b215edc8e45e5d66679f9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/3033ed903b4f28b5e1ab66042084fbc2c48f8624"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe5046ca91d631ec432eee3bdb1f1c49b09c8b5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d13afd021eb43868fe03cef6da34ad08831ad6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a14fad8be178df6c4589667efec1789a3307b4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4a90b543d9f62d3ac34ec1ab97fc5334b048565"
        }
      ],
      "title": "ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-46798",
    "datePublished": "2024-09-18T07:12:52.628Z",
    "dateReserved": "2024-09-11T15:12:18.280Z",
    "dateUpdated": "2026-08-05T11:38:37.461Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-46798",
      "date": "2026-08-05",
      "epss": "0.00215",
      "percentile": "0.1192"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.4\", \"versionEndExcluding\": \"5.4.284\", \"matchCriteriaId\": \"6ACBB349-F6C0-4395-8228-F0758C99886A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.5\", \"versionEndExcluding\": \"5.10.226\", \"matchCriteriaId\": \"864FC17C-501A-4823-A643-6F35D65D8A97\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.167\", \"matchCriteriaId\": \"043405A4-25FE-45D4-A7BB-2A0C3B7D17C1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.110\", \"matchCriteriaId\": \"6B1A95FC-7E7E-428B-BB59-F76640C652AE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.51\", \"matchCriteriaId\": \"E4529134-BAC4-4776-840B-304009E181A0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.10\", \"matchCriteriaId\": \"ACDEE48C-137A-4731-90D0-A675865E1BED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"39889A68-6D34-47A6-82FC-CD0BF23D6754\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nASoC: dapm: Fix UAF for snd_soc_pcm_runtime object\\n\\nWhen using kernel with the following extra config,\\n\\n  - CONFIG_KASAN=y\\n  - CONFIG_KASAN_GENERIC=y\\n  - CONFIG_KASAN_INLINE=y\\n  - CONFIG_KASAN_VMALLOC=y\\n  - CONFIG_FRAME_WARN=4096\\n\\nkernel detects that snd_pcm_suspend_all() access a freed\\n\u0027snd_soc_pcm_runtime\u0027 object when the system is suspended, which\\nleads to a use-after-free bug:\\n\\n[   52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270\\n[   52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330\\n\\n[   52.047785] Call trace:\\n[   52.047787]  dump_backtrace+0x0/0x3c0\\n[   52.047794]  show_stack+0x34/0x50\\n[   52.047797]  dump_stack_lvl+0x68/0x8c\\n[   52.047802]  print_address_description.constprop.0+0x74/0x2c0\\n[   52.047809]  kasan_report+0x210/0x230\\n[   52.047815]  __asan_report_load1_noabort+0x3c/0x50\\n[   52.047820]  snd_pcm_suspend_all+0x1a8/0x270\\n[   52.047824]  snd_soc_suspend+0x19c/0x4e0\\n\\nThe snd_pcm_sync_stop() has a NULL check on \u0027substream-\u003eruntime\u0027 before\\nmaking any access. So we need to always set \u0027substream-\u003eruntime\u0027 to NULL\\neverytime we kfree() it.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ASoC: dapm: Corregir UAF para el objeto snd_soc_pcm_runtime Cuando se usa el kernel con la siguiente configuraci\\u00f3n adicional, - CONFIG_KASAN=y - CONFIG_KASAN_GENERIC=y - CONFIG_KASAN_INLINE=y - CONFIG_KASAN_VMALLOC=y - CONFIG_FRAME_WARN=4096 el kernel detecta que snd_pcm_suspend_all() accede a un objeto \u0027snd_soc_pcm_runtime\u0027 liberado cuando el sistema est\\u00e1 suspendido, lo que conduce a un error de use after free: [ 52.047746] ERROR: KASAN: use after free en snd_pcm_suspend_all+0x1a8/0x270 [ 52.047765] Lectura de tama\\u00f1o 1 en la direcci\\u00f3n ffff0000b9434d50 por la tarea systemd-sleep/2330 [ 52.047785] Seguimiento de llamadas: [ 52.047787] dump_backtrace+0x0/0x3c0 [ 52.047794] show_stack+0x34/0x50 [ 52.047797] dump_stack_lvl+0x68/0x8c [ 52.047802] print_address_description.constprop.0+0x74/0x2c0 [ 52.047809] kasan_report+0x210/0x230 [ 52.047815] __asan_report_load1_noabort+0x3c/0x50 [ 52.047820] snd_pcm_suspend_all+0x1a8/0x270 [ 52.047824] snd_soc_suspend+0x19c/0x4e0 La funci\\u00f3n snd_pcm_sync_stop() tiene una comprobaci\\u00f3n NULL en \u0027substream-\u0026gt;runtime\u0027 antes de realizar cualquier acceso. Por lo tanto, siempre debemos establecer \u0027substream-\u0026gt;runtime\u0027 en NULL cada vez que lo ejecutamos con kfree().\"}]",
      "id": "CVE-2024-46798",
      "lastModified": "2024-09-20T18:17:50.763",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.9}]}",
      "published": "2024-09-18T08:15:06.463",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/3033ed903b4f28b5e1ab66042084fbc2c48f8624\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5d13afd021eb43868fe03cef6da34ad08831ad6d\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/6a14fad8be178df6c4589667efec1789a3307b4e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/8ca21e7a27c66b95a4b215edc8e45e5d66679f9f\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/993b60c7f93fa1d8ff296b58f646a867e945ae89\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b4a90b543d9f62d3ac34ec1ab97fc5334b048565\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/fe5046ca91d631ec432eee3bdb1f1c49b09c8b5e\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-416\"}]}]"
    },
    "microsoft_vex": {
      "current_release_date": "2026-02-21T02:05:36.000Z",
      "cve": "CVE-2024-46798",
      "id": "msrc_CVE-2024-46798",
      "initial_release_date": "2024-09-01T07:00:00.000Z",
      "product_status:fixed": "5",
      "product_status:known_affected": "5",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object",
      "url": "https://msrc.microsoft.com/csaf/vex/2024/msrc_cve-2024-46798.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-46798\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-18T08:15:06.463\",\"lastModified\":\"2026-08-04T11:20:26.700\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nASoC: dapm: Fix UAF for snd_soc_pcm_runtime object\\n\\nWhen using kernel with the following extra config,\\n\\n  - CONFIG_KASAN=y\\n  - CONFIG_KASAN_GENERIC=y\\n  - CONFIG_KASAN_INLINE=y\\n  - CONFIG_KASAN_VMALLOC=y\\n  - CONFIG_FRAME_WARN=4096\\n\\nkernel detects that snd_pcm_suspend_all() access a freed\\n\u0027snd_soc_pcm_runtime\u0027 object when the system is suspended, which\\nleads to a use-after-free bug:\\n\\n[   52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270\\n[   52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330\\n\\n[   52.047785] Call trace:\\n[   52.047787]  dump_backtrace+0x0/0x3c0\\n[   52.047794]  show_stack+0x34/0x50\\n[   52.047797]  dump_stack_lvl+0x68/0x8c\\n[   52.047802]  print_address_description.constprop.0+0x74/0x2c0\\n[   52.047809]  kasan_report+0x210/0x230\\n[   52.047815]  __asan_report_load1_noabort+0x3c/0x50\\n[   52.047820]  snd_pcm_suspend_all+0x1a8/0x270\\n[   52.047824]  snd_soc_suspend+0x19c/0x4e0\\n\\nThe snd_pcm_sync_stop() has a NULL check on \u0027substream-\u003eruntime\u0027 before\\nmaking any access. So we need to always set \u0027substream-\u003eruntime\u0027 to NULL\\neverytime we kfree() it.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ASoC: dapm: Corregir UAF para el objeto snd_soc_pcm_runtime Cuando se usa el kernel con la siguiente configuraci\u00f3n adicional, - CONFIG_KASAN=y - CONFIG_KASAN_GENERIC=y - CONFIG_KASAN_INLINE=y - CONFIG_KASAN_VMALLOC=y - CONFIG_FRAME_WARN=4096 el kernel detecta que snd_pcm_suspend_all() accede a un objeto \u0027snd_soc_pcm_runtime\u0027 liberado cuando el sistema est\u00e1 suspendido, lo que conduce a un error de use after free: [ 52.047746] ERROR: KASAN: use after free en snd_pcm_suspend_all+0x1a8/0x270 [ 52.047765] Lectura de tama\u00f1o 1 en la direcci\u00f3n ffff0000b9434d50 por la tarea systemd-sleep/2330 [ 52.047785] Seguimiento de llamadas: [ 52.047787] dump_backtrace+0x0/0x3c0 [ 52.047794] show_stack+0x34/0x50 [ 52.047797] dump_stack_lvl+0x68/0x8c [ 52.047802] print_address_description.constprop.0+0x74/0x2c0 [ 52.047809] kasan_report+0x210/0x230 [ 52.047815] __asan_report_load1_noabort+0x3c/0x50 [ 52.047820] snd_pcm_suspend_all+0x1a8/0x270 [ 52.047824] snd_soc_suspend+0x19c/0x4e0 La funci\u00f3n snd_pcm_sync_stop() tiene una comprobaci\u00f3n NULL en \u0027substream-\u0026gt;runtime\u0027 antes de realizar cualquier acceso. Por lo tanto, siempre debemos establecer \u0027substream-\u0026gt;runtime\u0027 en NULL cada vez que lo ejecutamos con kfree().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"sound/soc/soc-dapm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0\",\"lessThan\":\"993b60c7f93fa1d8ff296b58f646a867e945ae89\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0\",\"lessThan\":\"8ca21e7a27c66b95a4b215edc8e45e5d66679f9f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0\",\"lessThan\":\"3033ed903b4f28b5e1ab66042084fbc2c48f8624\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0\",\"lessThan\":\"fe5046ca91d631ec432eee3bdb1f1c49b09c8b5e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0\",\"lessThan\":\"5d13afd021eb43868fe03cef6da34ad08831ad6d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0\",\"lessThan\":\"6a14fad8be178df6c4589667efec1789a3307b4e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0\",\"lessThan\":\"b4a90b543d9f62d3ac34ec1ab97fc5334b048565\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"sound/soc/soc-dapm.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.284\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.226\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.167\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.110\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.51\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.10.10\",\"lessThanOrEqual\":\"6.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.11\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-29T14:22:12.387041Z\",\"id\":\"CVE-2024-46798\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.4\",\"versionEndExcluding\":\"5.4.284\",\"matchCriteriaId\":\"6ACBB349-F6C0-4395-8228-F0758C99886A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.226\",\"matchCriteriaId\":\"864FC17C-501A-4823-A643-6F35D65D8A97\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.167\",\"matchCriteriaId\":\"043405A4-25FE-45D4-A7BB-2A0C3B7D17C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.110\",\"matchCriteriaId\":\"6B1A95FC-7E7E-428B-BB59-F76640C652AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.51\",\"matchCriteriaId\":\"E4529134-BAC4-4776-840B-304009E181A0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.10\",\"matchCriteriaId\":\"ACDEE48C-137A-4731-90D0-A675865E1BED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"39889A68-6D34-47A6-82FC-CD0BF23D6754\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B8383ABF-1457-401F-9B61-EE50F4C61F4F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"B77A9280-37E6-49AD-B559-5B23A3B1DC3D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3033ed903b4f28b5e1ab66042084fbc2c48f8624\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5d13afd021eb43868fe03cef6da34ad08831ad6d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6a14fad8be178df6c4589667efec1789a3307b4e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8ca21e7a27c66b95a4b215edc8e45e5d66679f9f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/993b60c7f93fa1d8ff296b58f646a867e945ae89\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b4a90b543d9f62d3ac34ec1ab97fc5334b048565\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fe5046ca91d631ec432eee3bdb1f1c49b09c8b5e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2024/10/msg00003.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T18:02:38+00:00",
      "cve": "CVE-2024-46798",
      "id": "CVE-2024-46798",
      "initial_release_date": "2024-09-18T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-46798.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-23T01:59:33Z",
      "cve": "CVE-2024-46798",
      "id": "CVE-2024-46798",
      "initial_release_date": "2024-09-19T03:09:38Z",
      "product_status:known_affected": "401",
      "product_status:known_not_affected": "186",
      "product_status:recommended": "645",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-46798",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-46798.json",
      "version": "54"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-46798\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T14:22:12.387041Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T14:22:13.612Z\"}}], \"cna\": {\"title\": \"ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0\", \"lessThan\": \"993b60c7f93fa1d8ff296b58f646a867e945ae89\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0\", \"lessThan\": \"8ca21e7a27c66b95a4b215edc8e45e5d66679f9f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0\", \"lessThan\": \"3033ed903b4f28b5e1ab66042084fbc2c48f8624\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0\", \"lessThan\": \"fe5046ca91d631ec432eee3bdb1f1c49b09c8b5e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0\", \"lessThan\": \"5d13afd021eb43868fe03cef6da34ad08831ad6d\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0\", \"lessThan\": \"6a14fad8be178df6c4589667efec1789a3307b4e\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a72706ed8208ac3f72d1c3ebbc6509e368b0dcb0\", \"lessThan\": \"b4a90b543d9f62d3ac34ec1ab97fc5334b048565\", \"versionType\": \"git\"}], \"programFiles\": [\"sound/soc/soc-dapm.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.4\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.4\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.284\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.226\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.167\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.110\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.51\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.10\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"sound/soc/soc-dapm.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/993b60c7f93fa1d8ff296b58f646a867e945ae89\"}, {\"url\": \"https://git.kernel.org/stable/c/8ca21e7a27c66b95a4b215edc8e45e5d66679f9f\"}, {\"url\": \"https://git.kernel.org/stable/c/3033ed903b4f28b5e1ab66042084fbc2c48f8624\"}, {\"url\": \"https://git.kernel.org/stable/c/fe5046ca91d631ec432eee3bdb1f1c49b09c8b5e\"}, {\"url\": \"https://git.kernel.org/stable/c/5d13afd021eb43868fe03cef6da34ad08831ad6d\"}, {\"url\": \"https://git.kernel.org/stable/c/6a14fad8be178df6c4589667efec1789a3307b4e\"}, {\"url\": \"https://git.kernel.org/stable/c/b4a90b543d9f62d3ac34ec1ab97fc5334b048565\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nASoC: dapm: Fix UAF for snd_soc_pcm_runtime object\\n\\nWhen using kernel with the following extra config,\\n\\n  - CONFIG_KASAN=y\\n  - CONFIG_KASAN_GENERIC=y\\n  - CONFIG_KASAN_INLINE=y\\n  - CONFIG_KASAN_VMALLOC=y\\n  - CONFIG_FRAME_WARN=4096\\n\\nkernel detects that snd_pcm_suspend_all() access a freed\\n\u0027snd_soc_pcm_runtime\u0027 object when the system is suspended, which\\nleads to a use-after-free bug:\\n\\n[   52.047746] BUG: KASAN: use-after-free in snd_pcm_suspend_all+0x1a8/0x270\\n[   52.047765] Read of size 1 at addr ffff0000b9434d50 by task systemd-sleep/2330\\n\\n[   52.047785] Call trace:\\n[   52.047787]  dump_backtrace+0x0/0x3c0\\n[   52.047794]  show_stack+0x34/0x50\\n[   52.047797]  dump_stack_lvl+0x68/0x8c\\n[   52.047802]  print_address_description.constprop.0+0x74/0x2c0\\n[   52.047809]  kasan_report+0x210/0x230\\n[   52.047815]  __asan_report_load1_noabort+0x3c/0x50\\n[   52.047820]  snd_pcm_suspend_all+0x1a8/0x270\\n[   52.047824]  snd_soc_suspend+0x19c/0x4e0\\n\\nThe snd_pcm_sync_stop() has a NULL check on \u0027substream-\u003eruntime\u0027 before\\nmaking any access. So we need to always set \u0027substream-\u003eruntime\u0027 to NULL\\neverytime we kfree() it.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.284\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.226\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.167\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.110\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.51\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.10\", \"versionStartIncluding\": \"5.4\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.4\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:34:34.568Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-46798\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-04T09:34:34.568Z\", \"dateReserved\": \"2024-09-11T15:12:18.280Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-18T07:12:52.628Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.