CVE-2024-53239

A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) 6fire audio driver. During device disconnection, the driver prematurely releases resources while the sound card object remains in use, causing a use-after-free condition where memory is accessed after being released. A local user could exploit this vulnerability to cause a Denial of Service (DoS) by crashing the system.

This issue is considered to be a moderate impact flaw, as the exploitation for this will need an ADMIN (or ROOT) privilege (PR:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the snd-usb-6fire kernel module from being loaded by creating a blacklist configuration file:

# echo "install snd-usb-6fire /bin/true" > /etc/modprobe.d/disable-snd-usb-6fire.conf

If the module is currently loaded, unload it with:

# modprobe -r snd-usb-6fire

Caveats: This procedure disables support for TerraTec DMX 6Fire USB audio hardware. If the module is in active use and cannot be unloaded dynamically, a system reboot will be required to apply the configuration.