In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item There is no links_num in struct snd_soc_acpi_mach {}, and we test !link->num_adr as a condition to end the loop in hda_sdw_machine_select(). So an empty item in struct snd_soc_acpi_link_adr array is required.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-lnl-match:
    add missing empty item There is no links_num in struct snd_soc_acpi_mach {}, and we test !link->num_adr as     a condition to end the loop in hda_sdw_machine_select(). So an empty item in struct snd_soc_acpi_link_adr     array is required. (CVE-2024-46863)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the kernel-5.14.0-554.el9 build changelog.

  - In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB array     access ASIHPI driver stores some values in the static array upon a response from the driver, and its index     depends on the firmware. We shouldn't trust it blindly. This patch adds a sanity check of the array index     to fit in the array size. (CVE-2024-50007)

  - In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: cs35l41: Possible null     pointer dereference in cs35l41_hda_unbind() The cs35l41_hda_unbind() function clears the hda_component     entry matching it's index and then dereferences the codec pointer held in the first element of the     hda_component array, this is an issue when the device index was 0. Instead use the codec pointer stashed     in the cs35l41_hda structure as it will still be valid. (CVE-2024-40964)

  - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: fix null deref     on system suspend entry When system enters suspend with an active stream, SOF core calls     hw_params_upon_resume(). On Intel platforms with HDA DMA used to manage the link DMA, this leads to call     chain of hda_dsp_set_hw_params_upon_resume() -> hda_dsp_dais_suspend() -> hda_dai_suspend() ->     hda_ipc4_post_trigger() A bug is hit in hda_dai_suspend() as hda_link_dma_cleanup() is run first, which     clears hext_stream->link_substream, and then hda_ipc4_post_trigger() is called with a NULL     snd_pcm_substream pointer. (CVE-2024-41037)

  - In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Fix references to     freed memory Most users after parsing a topology file, release memory used by it, so having pointer     references directly into topology file contents is wrong. Use devm_kmemdup(), to allocate memory as     needed. (CVE-2024-41069)

  - In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp: add a null check for     chip_pdev structure When acp platform device creation is skipped, chip->chip_pdev value will remain NULL.
    Add NULL check for chip->chip_pdev structure in snd_acp_resume() function to avoid null pointer     dereference. (CVE-2024-42074)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-46863 advisory.

  - In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-lnl-match:
    add missing empty item There is no links_num in struct snd_soc_acpi_mach {}, and we test !link->num_adr as     a condition to end the loop in hda_sdw_machine_select(). So an empty item in struct snd_soc_acpi_link_adr     array is required. (CVE-2024-46863)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
229021	Linux Distros Unpatched Vulnerability : CVE-2024-46863	Nessus	Misc.	medium
214579	CentOS 9 : kernel-5.14.0-554.el9	Nessus	CentOS Local Security Checks	high
208877	CBL Mariner 2.0 Security Update: kernel (CVE-2024-46863)	Nessus	MarinerOS Local Security Checks	medium

Detections

Analytics

CVE-2024-46863

medium

Tenable Plugins

medium

high

medium