CVE-2023-54084

A potential use-after-free vulnerability was found in the Linux kernel's ALSA firewire-digi00x driver. When init_stream() fails, the error handling code incorrectly frees dg00x->rx_stream but returns success instead of an error code. This leaves a dangling pointer that can be dereferenced later, leading to a use-after-free condition.

This flaw affects systems with Digidesign Digi 002/003 FireWire audio interfaces using the snd-firewire-digi00x driver. The use-after-free can occur when stream initialization fails, which is an uncommon error condition during device setup. Physical access to connect the specific hardware is required.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the snd_firewire_digi00x module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.