Linux Kernel
CVE-2024-38605
HIGH
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition timing requirement and non-default mixed build configuration justify AC:H over NVD's AC:L; PR:L and AV:L are correct for local low-privilege access.
Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).
CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ALSA: core: Fix NULL module pointer assignment at card init
The commit 81033c6b584b ("ALSA: core: Warn on empty module") introduced a WARN_ON() for a NULL module pointer passed at snd_card object creation, and it also wraps the code around it with '#ifdef MODULE'. This works in most cases, but the devils are always in details. "MODULE" is defined when the target code (i.e. the sound core) is built as a module; but this doesn't mean that the caller is also built-in or not. Namely, when only the sound core is built-in (CONFIG_SND=y) while the driver is a module (CONFIG_SND_USB_AUDIO=m), the passed module pointer is ignored even if it's non-NULL, and card->module remains as NULL. This would result in the missing module reference up/down at the device open/close, leading to a race with the code execution after the module removal.
For addressing the bug, move the assignment of card->module again out of ifdef. The WARN_ON() is still wrapped with ifdef because the module can be really NULL when all sound drivers are built-in.
Note that we keep 'ifdef MODULE' for WARN_ON(), otherwise it would lead to a false-positive NULL module check. Admittedly it won't catch perfectly, i.e. no check is performed when CONFIG_SND=y. But, it's no real problem as it's only for debugging, and the condition is pretty rare.
AnalysisAI
NULL module pointer assignment in the Linux kernel ALSA sound core creates a reference-counting gap that enables a race condition between device open/close operations and module unloading. When the ALSA sound core is built into the kernel (CONFIG_SND=y) but a sound driver such as CONFIG_SND_USB_AUDIO is compiled as a loadable module, a misplaced #ifdef MODULE guard causes card->module to remain NULL, bypassing module reference tracking entirely. A local attacker with low privileges can exploit the resulting race - opening a sound device then triggering or racing a module unload - to potentially cause a kernel crash (DoS) or, in the best-case scenario for an attacker, achieve arbitrary code execution in kernel context. No public exploit identified at time of analysis; EPSS of 1.09% (61st percentile) reflects moderate research interest with low absolute exploitation probability, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
The ALSA (Advanced Linux Sound Architecture) subsystem manages sound card lifecycle in the Linux kernel via snd_card objects. During snd_card creation, the caller passes its own module pointer so the kernel can perform reference counting (module_get/module_put) on device open/close, preventing module unload while the device is in use. Commit 81033c6b584b introduced a WARN_ON() for NULL module pointers wrapped in #ifdef MODULE, which is defined only when the sound core itself is built as a module (CONFIG_SND=m). When CONFIG_SND=y (built-in) and a driver like CONFIG_SND_USB_AUDIO=m is a module, the guard silently swallows the non-NULL module pointer passed by the driver, leaving card->module as NULL. CWE-476 (NULL Pointer Dereference) is the listed root cause class, but the actual exploitable condition is a classic TOCTOU race: without module_get() at open time, the kernel cannot prevent the module from being freed while its code is actively executing, yielding a use-after-free condition in kernel space. CPE cpe:2.3:o:linux:linux_kernel covers all affected branches, with fixes distributed across multiple stable trees.
RemediationAI
Apply the upstream kernel stable patches available at https://git.kernel.org/stable/c/39381fe7394e5eafac76e7e9367e7351138a29c1 and the six accompanying stable-tree commits (6b8374ee2cab, c935e72139e6, d7ff29a429b5, e00747672573, e644036a3e2b, e7e0ca200772). Distribution users should apply the next kernel security update from their vendor once these commits are integrated. As a compensating control, reconfigure the kernel to build CONFIG_SND=m (as a module) rather than built-in, which ensures the #ifdef MODULE guard evaluates correctly and card->module is assigned; note this requires a kernel rebuild and may affect boot-time sound availability if initramfs is not updated. Alternatively, ensuring all ALSA drivers in use are also built-in (=y) eliminates the mixed-linkage condition, though this is impractical for general-purpose systems. No known performance or stability side effects of the patch itself - it is a single-line assignment moved out of a conditional block.
Same weakness CWE-476 – NULL Pointer Dereference
View allShare
External POC / Exploit Code
Leaving vuln.today