CVE-2024-38618: ALSA: timer: Set lower bound of start tick time
In the Linux kernel, the following vulnerability has been resolved:
ALSA: timer: Set lower bound of start tick time
Currently ALSA timer doesn't have the lower limit of the start tick time, and it allows a very small size, e.g. 1 tick with 1ns resolution for hrtimer. Such a situation may lead to an unexpected RCU stall, where the callback repeatedly queuing the expire update, as reported by fuzzer.
This patch introduces a sanity check of the timer start tick time, so that the system returns an error when a too small start size is set. As of this patch, the lower limit is hard-coded to 100us, which is small enough but can still work somehow.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ALSA: timer: Set lower bound of start tick time
The Linux kernel CVE team has assigned CVE-2024-38618 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024061923-CVE-2024-38618-35a9@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 4.19.316 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.4.278 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.10.219 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.161 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.93 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.33 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9.3 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Upgrade
Upgrade
Linux kernel (ALSA timer)to a version that resolves this vulnerability.Patch CVE-2024-38618
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38618?
CVE-2024-38618 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-38618?
To fix CVE-2024-38618, update the Linux kernel to versions 4.19.316, 5.4.278, 5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.9.3, or 6.10 as per the advisories.
What versions of the Linux kernel are affected by CVE-2024-38618?
The affected versions of the Linux kernel are prior to 4.19.316, 5.4.278, 5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.9.3, and 6.10.
What component is impacted by CVE-2024-38618?
CVE-2024-38618 impacts the ALSA timer component of the Linux kernel.
Is there a workaround for CVE-2024-38618?
There are currently no known workarounds for CVE-2024-38618, and patching is the recommended approach.