CVE-2024-44954

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-44954
In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Fix racy access to midibuf There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by syzkaller below (so put as reported-by here). This patch protects the midibuf call of the former code path with a spinlock for avoiding the possible races.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/15b7a03205b31bc5623378c190d22b7ff60026f1 Patch
https://git.kernel.org/stable/c/40f3d5cb0e0cbf7fa697913a27d5d361373bdcf5 Patch
https://git.kernel.org/stable/c/51d87f11dd199bbc6a85982b088ff27bde53b48a Patch
https://git.kernel.org/stable/c/535df7f896a568a8a1564114eaea49d002cb1747 Patch
https://git.kernel.org/stable/c/643293b68fbb6c03f5e907736498da17d43f0d81 Patch
https://git.kernel.org/stable/c/a54da4b787dcac60b598da69c9c0072812b8282d Patch
https://git.kernel.org/stable/c/c80f454a805443c274394b1db0d1ebf477abd94e Patch
https://git.kernel.org/stable/c/e7e7d2b180d8f297cea6db43ea72402fd33e1a29 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
History

10 Oct 2024, 18:02

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
References () https://git.kernel.org/stable/c/15b7a03205b31bc5623378c190d22b7ff60026f1 - () https://git.kernel.org/stable/c/15b7a03205b31bc5623378c190d22b7ff60026f1 - Patch
References () https://git.kernel.org/stable/c/40f3d5cb0e0cbf7fa697913a27d5d361373bdcf5 - () https://git.kernel.org/stable/c/40f3d5cb0e0cbf7fa697913a27d5d361373bdcf5 - Patch
References () https://git.kernel.org/stable/c/51d87f11dd199bbc6a85982b088ff27bde53b48a - () https://git.kernel.org/stable/c/51d87f11dd199bbc6a85982b088ff27bde53b48a - Patch
References () https://git.kernel.org/stable/c/535df7f896a568a8a1564114eaea49d002cb1747 - () https://git.kernel.org/stable/c/535df7f896a568a8a1564114eaea49d002cb1747 - Patch
References () https://git.kernel.org/stable/c/643293b68fbb6c03f5e907736498da17d43f0d81 - () https://git.kernel.org/stable/c/643293b68fbb6c03f5e907736498da17d43f0d81 - Patch
References () https://git.kernel.org/stable/c/a54da4b787dcac60b598da69c9c0072812b8282d - () https://git.kernel.org/stable/c/a54da4b787dcac60b598da69c9c0072812b8282d - Patch
References () https://git.kernel.org/stable/c/c80f454a805443c274394b1db0d1ebf477abd94e - () https://git.kernel.org/stable/c/c80f454a805443c274394b1db0d1ebf477abd94e - Patch
References () https://git.kernel.org/stable/c/e7e7d2b180d8f297cea6db43ea72402fd33e1a29 - () https://git.kernel.org/stable/c/e7e7d2b180d8f297cea6db43ea72402fd33e1a29 - Patch
First Time Linux linux Kernel
Linux
CWE CWE-362
CPE cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*

05 Sep 2024, 12:53

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: line6: Fix racy access to midibuf Puede haber accesos concurrentes a midibuf de line6 tanto desde la devolución de llamada de finalización de URB como desde el acceso a la API rawmidi. Esto podría ser la causa de la advertencia KMSAN activada por syzkaller a continuación (así que se indica aquí). Este parche protege la llamada midibuf de la ruta de código anterior con un spinlock para evitar las posibles ejecuciones.

04 Sep 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-04 19:15

Updated : 2024-10-10 18:02

NVD link : CVE-2024-44954

Mitre link : CVE-2024-44954

CVE.ORG link : CVE-2024-44954

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')