Allele Security Intelligence - ASA-2018-00068 – Linux kernel: Use-after-free in usb_audio

Allele Security Alert

ASA-2018-00068

Identifier(s)

ASA-2018-00068, CVE-2018-19824

Title

Use-after-free in usb_audio_probe()

Vendor(s)

Linux foundation

Product(s)

Linux kernel

Affected version(s)

Linux kernel versions before 4.20

Linux kernel versions before 4.9.145
Linux kernel versions before 4.19.9
Linux kernel versions before 4.14.88
Linux kernel versions before 4.4.167
Linux kernel versions before 3.16.63

Fixed version(s)

Linux kernel version 4.20

Linux kernel version 4.9.145
Linux kernel version 4.19.9
Linux kernel version 4.14.88
Linux kernel version 4.4.167
Linux kernel version 3.16.63

Proof of concept

Unknown

Description

There is a use-after-free vulnerability in usb_audio_probe(). This function accesses a freed object when decrementing its reference counter. The attacker needs local access to plug in a malicious USB device in order to exploit the vulnerability.

Technical details

If a USB sound card reports 0 interface, an error condition is triggered and the function usb_audio_probe() errors out. In the error path, there was a use-after-free vulnerability where the memory object of the card was first freed, followed by a decrement of the number of active chips.

File: sound/usb/card.c
---
 __error:
if (chip) {
+ /* chip->active is inside the chip->card object,
+ * decrement before memory is possibly returned.
+ */
+ atomic_dec(&chip->active);
if (!chip->num_interfaces)
snd_card_free(chip->card);
- atomic_dec(&chip->active);
}
mutex_unlock(&register_mutex);
return err;
---