CVE-2024-44954: ALSA: line6: Fix racy access to midibuf
In the Linux kernel, the following vulnerability has been resolved:
ALSA: line6: Fix racy access to midibuf
There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by syzkaller below (so put as reported-by here).
This patch protects the midibuf call of the former code path with a spinlock for avoiding the possible races.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-44954?
CVE-2024-44954 has a moderate severity level due to its ability to cause concurrency issues in the ALSA line6 driver.
How do I fix CVE-2024-44954?
To fix CVE-2024-44954, update your Linux kernel to version 5.10.226-1, 6.1.123-1, or apply the respective patches mentioned in the advisory.
What systems are affected by CVE-2024-44954?
CVE-2024-44954 affects multiple versions of the Linux kernel, specifically those before 5.10.224 and kernel version 6.11-rc2.
What is the potential impact of CVE-2024-44954?
The potential impact of CVE-2024-44954 includes possible denial of service or abnormal system behavior due to concurrent access issues.
Who is impacted by CVE-2024-44954?
Users and administrators of affected Linux distributions using the ALSA line6 driver may experience risks associated with CVE-2024-44954.