CVE-2024-38618: ALSA: timer: Set lower bound of start tick time
In the Linux kernel, the following vulnerability has been resolved:
ALSA: timer: Set lower bound of start tick time
Currently ALSA timer doesn't have the lower limit of the start tick time, and it allows a very small size, e.g. 1 tick with 1ns resolution for hrtimer. Such a situation may lead to an unexpected RCU stall, where the callback repeatedly queuing the expire update, as reported by fuzzer.
This patch introduces a sanity check of the timer start tick time, so that the system returns an error when a too small start size is set. As of this patch, the lower limit is hard-coded to 100us, which is small enough but can still work somehow.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ALSA: timer: Set lower bound of start tick time
The Linux kernel CVE team has assigned CVE-2024-38618 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024061923-CVE-2024-38618-35a9@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-38618?
CVE-2024-38618 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-38618?
To fix CVE-2024-38618, update the Linux kernel to versions 4.19.316, 5.4.278, 5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.9.3, or 6.10 as per the advisories.
What versions of the Linux kernel are affected by CVE-2024-38618?
The affected versions of the Linux kernel are prior to 4.19.316, 5.4.278, 5.10.219, 5.15.161, 6.1.93, 6.6.33, 6.9.3, and 6.10.
What component is impacted by CVE-2024-38618?
CVE-2024-38618 impacts the ALSA timer component of the Linux kernel.
Is there a workaround for CVE-2024-38618?
There are currently no known workarounds for CVE-2024-38618, and patching is the recommended approach.