CVE-2024-26654: ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
In the Linux kernel, the following vulnerability has been resolved:
ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
The dreamcastcard->timer could schedule the spudmawork and the spudmawork could also arm the dreamcastcard->timer.
When the sndpcmsubstream is closing, the aicachannel will be deallocated. But it could still be dereferenced in the worker thread. The reason is that deltimer() will return directly regardless of whether the timer handler is running or not and the worker could be rescheduled in the timer handler. As a result, the UAF bug will happen. The racy situation is shown below:
(Thread 1) | (Thread 2) sndaicapcmpcmclose() | ... | runspudma() //worker | modtimer() flushwork() | deltimer() | aicaperiodelapsed() //timer kfree(dreamcastcard->channel) | schedulework() | runspudma() //worker ... | dreamcastcard->channel-> //USE
In order to mitigate this bug and other possible corner cases, call modtimer() conditionally in runspudma(), then implement PCM syncstop op to cancel both the timer and worker. The syncstop op will be called from PCM core appropriately when needed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26654?
CVE-2024-26654 is classified as a medium severity vulnerability in the Linux kernel affecting ALSA.
How do I fix CVE-2024-26654?
To remediate CVE-2024-26654, update to the following versions of the Linux package: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.10-1, or 6.12.11-1.
What are the potential impacts of CVE-2024-26654?
The impacts of CVE-2024-26654 can include user-after-free errors potentially leading to memory corruption.
Is my system affected by CVE-2024-26654?
If you are using an affected Linux kernel version prior to the fixed releases, your system may be vulnerable to CVE-2024-26654.
When was CVE-2024-26654 first reported?
CVE-2024-26654 was reported in early 2024 as a vulnerability in the Linux kernel related to ALSA.