#VU102180 Improper locking in Linux kernel - CVE-2024-56531
Vulnerability identifier: #VU102180
Vulnerability risk: Low
CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-56531
CWE-ID:
CWE-667
Exploitation vector: Local
Exploit availability: No
Vulnerable software:
Linux kernel
Operating systems & Components /
Operating system
Vendor: Linux Foundation
Description
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper locking within the snd_usb_caiaq_input_free() function in sound/usb/caiaq/input.c, within the setup_card(), init_card() and snd_disconnect() functions in sound/usb/caiaq/device.c, within the snd_usb_caiaq_audio_init() function in sound/usb/caiaq/audio.c. A local user can perform a denial of service (DoS) attack.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Linux kernel: 5.4, 5.4.0, 5.4.0 rc6, 5.4.1, 5.4.2, 5.4.3, 5.4.4, 5.4.5, 5.4.6, 5.4.7, 5.4.8, 5.4.9, 5.4.10, 5.4.11, 5.4.12, 5.4.13, 5.4.14, 5.4.15, 5.4.16, 5.4.17, 5.4.18, 5.4.19, 5.4.20, 5.4.21, 5.4.22, 5.4.23, 5.4.24, 5.4.25, 5.4.26, 5.4.27, 5.4.28, 5.4.29, 5.4.30, 5.4.31, 5.4.32, 5.4.33, 5.4.34, 5.4.35, 5.4.36, 5.4.37, 5.4.38, 5.4.39, 5.4.40, 5.4.41, 5.4.42, 5.4.43, 5.4.44, 5.4.45, 5.4.46, 5.4.47, 5.4.48, 5.4.49, 5.4.50, 5.4.51, 5.4.52, 5.4.53, 5.4.54, 5.4.55, 5.4.56, 5.4.57, 5.4.58, 5.4.59, 5.4.60, 5.4.61, 5.4.62, 5.4.63, 5.4.64, 5.4.65, 5.4.66, 5.4.67, 5.4.68, 5.4.69, 5.4.70, 5.4.71, 5.4.72, 5.4.73, 5.4.74, 5.4.75, 5.4.76, 5.4.77, 5.4.78, 5.4.79, 5.4.80, 5.4.81, 5.4.82, 5.4.83, 5.4.84, 5.4.85, 5.4.86, 5.4.87, 5.4.88, 5.4.89, 5.4.90, 5.4.91, 5.4.92, 5.4.93, 5.4.94, 5.4.95, 5.4.96, 5.4.97, 5.4.98, 5.4.99, 5.4.100, 5.4.101, 5.4.102, 5.4.103, 5.4.104, 5.4.105, 5.4.106, 5.4.107, 5.4.108, 5.4.109, 5.4.110, 5.4.111, 5.4.112, 5.4.113, 5.4.114, 5.4.115, 5.4.116, 5.4.117, 5.4.118, 5.4.119, 5.4.120, 5.4.121, 5.4.122, 5.4.123, 5.4.124, 5.4.125, 5.4.126, 5.4.127, 5.4.128, 5.4.129, 5.4.130, 5.4.131, 5.4.132, 5.4.133, 5.4.134, 5.4.135, 5.4.136, 5.4.137, 5.4.138, 5.4.139, 5.4.140, 5.4.141, 5.4.142, 5.4.143, 5.4.144, 5.4.145, 5.4.146, 5.4.147, 5.4.148, 5.4.149, 5.4.150, 5.4.151, 5.4.152, 5.4.153, 5.4.154, 5.4.155, 5.4.156, 5.4.157, 5.4.158, 5.4.159, 5.4.160, 5.4.161, 5.4.162, 5.4.163, 5.4.164, 5.4.165, 5.4.166, 5.4.167, 5.4.168, 5.4.169, 5.4.170, 5.4.171, 5.4.172, 5.4.173, 5.4.174, 5.4.175, 5.4.176, 5.4.177, 5.4.178, 5.4.179, 5.4.180, 5.4.181, 5.4.182, 5.4.183, 5.4.184, 5.4.185, 5.4.186, 5.4.187, 5.4.188, 5.4.189, 5.4.190, 5.4.191, 5.4.192, 5.4.193, 5.4.194, 5.4.195, 5.4.196, 5.4.197, 5.4.198, 5.4.199, 5.4.200, 5.4.201, 5.4.202, 5.4.203, 5.4.204, 5.4.205, 5.4.206, 5.4.207, 5.4.208, 5.4.209, 5.4.210, 5.4.211, 5.4.212, 5.4.213, 5.4.214, 5.4.215, 5.4.216, 5.4.217, 5.4.218, 5.4.219, 5.4.220, 5.4.221, 5.4.222, 5.4.223, 5.4.224, 5.4.225, 5.4.226, 5.4.227, 5.4.228, 5.4.229, 5.4.230, 5.4.231, 5.4.232, 5.4.233, 5.4.234, 5.4.235, 5.4.236, 5.4.237, 5.4.238, 5.4.239, 5.4.240, 5.4.241, 5.4.242, 5.4.243, 5.4.244, 5.4.245, 5.4.246, 5.4.247, 5.4.248, 5.4.249, 5.4.250, 5.4.251, 5.4.252, 5.4.253, 5.4.254, 5.4.255, 5.4.256, 5.4.257, 5.4.258, 5.4.259, 5.4.260, 5.4.261, 5.4.262, 5.4.263, 5.4.264, 5.4.265, 5.4.266, 5.4.267, 5.4.268, 5.4.269, 5.4.270, 5.4.271, 5.4.272, 5.4.273, 5.4.274, 5.4.275, 5.4.276, 5.4.277, 5.4.278, 5.4.279, 5.4.280, 5.4.281, 5.4.282, 5.4.283, 5.4.284, 5.4.285, 5.4.286
External links
https://git.kernel.org/stable/c/237f3faf0177bdde728fa3106d730d806436aa4d
https://git.kernel.org/stable/c/3993edf44d3df7b6e8c753eac6ac8783473fcbab
https://git.kernel.org/stable/c/4507a8b9b30344c5ddd8219945f446d47e966a6d
https://git.kernel.org/stable/c/4dd821dcbfcecf7af6a08370b0b217cde2818acf
https://git.kernel.org/stable/c/a3f9314752dbb6f6aa1f0f2b4c58243bda800738
https://git.kernel.org/stable/c/b04dcbb7f7b1908806b7dc22671cdbe78ff2b82c
https://git.kernel.org/stable/c/cadf1d8e9ddcd74584ec961aeac14ac549b261d8
https://git.kernel.org/stable/c/dd0de8cb708951cebf727aa045e8242ba651bb52
https://git.kernel.org/stable/c/ebad462eec93b0f701dfe4de98990e7355283801
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.287
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
