CVE-2024-50104: Vulnerability in Linux Linux

Severity: mediumType: vulnerabilityCVE-2024-50104

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: sdm845: add missing soundwire runtime stream alloc During the migration of Soundwire runtime stream allocation from the Qualcomm Soundwire controller to SoC's soundcard drivers the sdm845 soundcard was forgotten. At this point any playback attempt or audio daemon startup, for instance on sdm845-db845c (Qualcomm RB3 board), will result in stream pointer NULL dereference: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=0000000101ecf000 [0000000000000020] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Modules linked in: ... CPU: 5 UID: 0 PID: 1198 Comm: aplay Not tainted 6.12.0-rc2-qcomlt-arm64-00059-g9d78f315a362-dirty #18 Hardware name: Thundercomm Dragonboard 845c (DT) pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : sdw_stream_add_slave+0x44/0x380 [soundwire_bus] lr : sdw_stream_add_slave+0x44/0x380 [soundwire_bus] sp : ffff80008a2035c0 x29: ffff80008a2035c0 x28: ffff80008a203978 x27: 0000000000000000 x26: 00000000000000c0 x25: 0000000000000000 x24: ffff1676025f4800 x23: ffff167600ff1cb8 x22: ffff167600ff1c98 x21: 0000000000000003 x20: ffff167607316000 x19: ffff167604e64e80 x18: 0000000000000000 x17: 0000000000000000 x16: ffffcec265074160 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : ffff167600ff1cec x5 : ffffcec22cfa2010 x4 : 0000000000000000 x3 : 0000000000000003 x2 : ffff167613f836c0 x1 : 0000000000000000 x0 : ffff16761feb60b8 Call trace: sdw_stream_add_slave+0x44/0x380 [soundwire_bus] wsa881x_hw_params+0x68/0x80 [snd_soc_wsa881x] snd_soc_dai_hw_params+0x3c/0xa4 __soc_pcm_hw_params+0x230/0x660 dpcm_be_dai_hw_params+0x1d0/0x3f8 dpcm_fe_dai_hw_params+0x98/0x268 snd_pcm_hw_params+0x124/0x460 snd_pcm_common_ioctl+0x998/0x16e8 snd_pcm_ioctl+0x34/0x58 __arm64_sys_ioctl+0xac/0xf8 invoke_syscall+0x48/0x104 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xe0 el0t_64_sync_handler+0x120/0x12c el0t_64_sync+0x190/0x194 Code: aa0403fb f9418400 9100e000 9400102f (f8420f22) ---[ end trace 0000000000000000 ]--- 0000000000006108 <sdw_stream_add_slave>: 6108: d503233f paciasp 610c: a9b97bfd stp x29, x30, [sp, #-112]! 6110: 910003fd mov x29, sp 6114: a90153f3 stp x19, x20, [sp, #16] 6118: a9025bf5 stp x21, x22, [sp, #32] 611c: aa0103f6 mov x22, x1 6120: 2a0303f5 mov w21, w3 6124: a90363f7 stp x23, x24, [sp, #48] 6128: aa0003f8 mov x24, x0 612c: aa0203f7 mov x23, x2 6130: a9046bf9 stp x25, x26, [sp, #64] 6134: aa0403f9 mov x25, x4 <-- x4 copied to x25 6138: a90573fb stp x27, x28, [sp, #80] 613c: aa0403fb mov x27, x4 6140: f9418400 ldr x0, [x0, #776] 6144: 9100e000 add x0, x0, #0x38 6148: 94000000 bl 0 <mutex_lock> 614c: f8420f22 ldr x2, [x25, #32]! <-- offset 0x44 ^^^ This is 0x6108 + offset 0x44 from the beginning of sdw_stream_add_slave() where data abort happens. wsa881x_hw_params() is called with stream = NULL and passes it further in register x4 (5th argu ---truncated---

AI Analysis

Technical Summary

CVE-2024-50104 is a vulnerability in the Linux kernel affecting the Qualcomm Soundwire (ASoC) driver for the sdm845 SoC, specifically the sdm845 soundcard implementation. The issue arises due to a missing runtime stream allocation during the migration of Soundwire stream management from the Qualcomm Soundwire controller to the SoC's soundcard drivers. This omission leads to a NULL pointer dereference when attempting audio playback or starting audio daemons on affected hardware such as the Qualcomm RB3 board (sdm845-db845c). The kernel attempts to access a stream pointer that has not been properly allocated, resulting in a kernel oops and crash. The detailed kernel trace shows the fault occurs in the function sdw_stream_add_slave(), where an invalid memory access at offset 0x44 from the function start causes a data abort. This vulnerability leads to a denial of service (DoS) condition by crashing the kernel when audio playback is initiated. The vulnerability is specific to Linux kernel versions containing the affected commit (15c7fab0e0477d7d7185eac574ca43c15b59b015) and hardware platforms using the Qualcomm sdm845 SoC with the affected soundcard driver. There is no indication of privilege escalation or remote code execution, but the kernel crash can disrupt system availability and stability. No known exploits are reported in the wild, and no CVSS score has been assigned yet. The vulnerability was published on November 5, 2024, and is resolved by adding the missing runtime stream allocation in the soundcard driver code.

Potential Impact

For European organizations, the impact of CVE-2024-50104 primarily concerns systems running Linux on Qualcomm sdm845-based hardware, such as embedded devices, development boards, or specialized industrial equipment. The vulnerability causes kernel crashes during audio playback attempts, leading to denial of service and potential disruption of services relying on audio functionality. Organizations using affected hardware in critical environments (e.g., telecommunications, industrial control, or embedded systems) may experience system instability or downtime. Although the vulnerability does not appear to allow privilege escalation or remote compromise, repeated crashes could impact operational continuity and require manual intervention to recover. The impact is limited to systems with the specific hardware and kernel versions, so widespread impact is unlikely unless these platforms are in use. However, organizations deploying Linux-based IoT or edge devices with Qualcomm sdm845 SoCs should be aware of this issue and plan for patching to maintain system reliability.

Mitigation Recommendations

To mitigate CVE-2024-50104, organizations should: 1) Identify and inventory all Linux systems running on Qualcomm sdm845 SoC hardware, particularly development boards like the Qualcomm RB3 or Thundercomm Dragonboard 845c. 2) Update the Linux kernel to a version that includes the patch fixing the missing Soundwire runtime stream allocation in the sdm845 soundcard driver. Since no patch links are provided, monitor official Linux kernel repositories and Qualcomm vendor updates for the fix. 3) If immediate patching is not possible, consider disabling audio playback functionality or audio daemons on affected devices to prevent triggering the NULL pointer dereference. 4) Implement monitoring for kernel oops or crashes related to audio playback to detect exploitation attempts or system instability. 5) For embedded or industrial deployments, coordinate with hardware vendors to obtain updated firmware or kernel builds incorporating the fix. 6) Maintain strict control over software updates and test kernel updates in staging environments to ensure stability before production deployment. These steps go beyond generic advice by focusing on hardware-specific identification, temporary functional workarounds, and vendor coordination.