ALSA usx2y: Null Address in free_pages_exact() Vulnerability
Summary
GSD-2021-1001279: ALSA: usx2y: Don't call free_pages_exact() with NULL address. Affects Kernel versions < 7d7f30cf182e55023fa8fde4c084b2d37c6be69d. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
ALSA (Advanced Linux Sound Architecture) is a software framework and part of the Linux kernel that provides an API for sound card drivers. It enables audio and MIDI functionality on Linux-based systems. The usx2y driver is a specific driver within ALSA that supports USB sound devices. This vulnerability affects the usx2y driver in the Linux kernel.
Vulnerability Detail
The vulnerability in the ALSA usx2y driver involves calling the free_pages_exact() function with a NULL address. This can lead to a NULL pointer dereference, causing a kernel crash or potential privilege escalation. An attacker with local access to the system may be able to exploit this vulnerability to gain elevated privileges or disrupt system stability.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the Linux kernel to the fixed version to mitigate the risk.
Conclusion
The ALSA usx2y driver vulnerability involving a NULL address in free_pages_exact() can lead to a kernel crash or privilege escalation. It is crucial to update the Linux kernel to version v5.10.52 or later to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ALSA (Advanced Linux Sound Architecture) is a software framework and part of the Linux kernel that provides an API for sound card drivers.
The usx2y driver is a specific driver within ALSA that supports USB sound devices.
The vulnerability can lead to a kernel crash or potential privilege escalation, allowing an attacker to gain elevated privileges or disrupt system stability.
To fix this vulnerability, update the Linux kernel to version v5.10.52 or later.
No, there is no known workaround for this vulnerability. Updating the kernel is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
