Critical Vulnerability in Linux Kernel: Link DMA Mismanagement
Summary
DEBIAN-CVE-2024-57805: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP The linkDMA should not be released on stop trigger since a stream re-start might happen w... Affects linux versions < 6.12.8-1. Fixed in 6.12.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It is widely used across various platforms, including servers, desktops, and embedded systems. This vulnerability affects the ASoC (ALSA System on Chip) subsystem, specifically the Intel hardware drivers, which manage audio streams. The issue arises from improper handling of link DMA (Direct Memory Access) during stream stop operations, potentially leading to resource conflicts and system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ASoC subsystem related to Intel hardware drivers. The issue occurs when the link DMA is released upon a stop trigger, which can lead to a scenario where another stream can 'steal' the link DMA before it is reallocated. This can result in mixed-up DMA channels, causing firmware errors or system crashes. The vulnerability is not easily reproducible under normal conditions, as streams are typically closed after stopping. However, if another stream is initiated during the stop and start process, it can lead to significant issues.
How To Fix
Minimum fixed version
6.12.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, users are advised to avoid initiating multiple audio streams simultaneously during the stop and start process to minimize the risk of encountering the issue.
Conclusion
The vulnerability in the Linux kernel related to link DMA mismanagement poses a significant risk to systems utilizing the ASoC subsystem for audio processing. Users are encouraged to update their kernels to the latest patched version to mitigate potential risks. Awareness of this issue and proactive measures can help maintain system stability and security.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to mixed-up DMA channels, resulting in firmware errors or crashes, particularly when multiple audio streams are managed simultaneously.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
Yes, the vulnerability has been patched in version 6.12.8-1 of the Linux kernel for both Debian 13 and Debian 14.
While there are no specific workarounds, it is advisable to avoid starting multiple audio streams during the stop and start process to reduce the risk of encountering issues.
Detailed information about this vulnerability can be found in the Debian CVE database or by using Vulert's playground to check for affected applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
