ALSA: usb-audio: Fix potential memory leaks at error path for UMP open (Linux Linux)

CVE-2023-54022
Non disponible

En bref

Source
NVD
EPSS
EPSS 0.17 % · centile 7 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Deferred

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential memory leaks at error path for UMP open The allocation and initialization errors at alloc_midi_urbs() that is called at MIDI 2.0 / UMP device are supposed to be handled at the caller side by invoking free_midi_urbs(). However, free_midi_urbs() loops only for ep->num_urbs entries, and since ep->num_entries wasn't updated yet at the allocation / init error in alloc_midi_urbs(), this entry won't be released. The intention of free_midi_urbs() is to release the whole elements, so change the loop size to NUM_URBS to scan over all elements for fixing the missed releases. Also, the call of free_midi_urbs() is missing at snd_usb_midi_v2_open(). Although it'll be released later at reopen/close or disconnection, it's better to release immediately at the error path.

Références

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
Linux · Linuxaffected ff49d1df79aef7580fe3ac99d17c3f886655d080 < f819b343aa95d24d5f7d6e06660c7f62591abc5f ; affected ff49d1df79aef7580fe3ac99d17c3f886655d080 < b1757fa30ef14f254f4719bf6f7d54a4c8207216
Linux · Linuxaffected 6.5 ; unaffected 0 < 6.5 ; unaffected 6.5.3 ≤ 6.5.* ; unaffected 6.6 ≤ *

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD