- Vulnerability/
- CVE-2024-57893
CVE-2024-57893: ALSA: seq: oss: Fix races at processing SysEx messages
First published: Wed Jan 15 2025(Updated: )
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix races at processing SysEx messages OSS sequencer handles the SysEx messages split in 6 bytes packets, and ALSA sequencer OSS layer tries to combine those. It stores the data in the internal buffer and this access is racy as of now, which may lead to the out-of-bounds access. As a temporary band-aid fix, introduce a mutex for serializing the process of the SysEx message packets.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Kernel | ||
| debian/linux | <=5.10.223-1<=5.10.234-1 | 6.1.129-1 6.1.128-1 6.12.20-1 6.12.21-1 |
| debian/linux-6.1 | 6.1.129-1~deb11u1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/0179488ca992d79908b8e26b9213f1554fc5bacc
- https://git.kernel.org/stable/c/9d382112b36382aa65aad765f189ebde9926c101
- https://git.kernel.org/stable/c/cff1de87ed14fc0f2332213d2367100e7ad0753a
- https://git.kernel.org/stable/c/d2392b79d8af3714ea8878b71c66dc49d3110f44
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-57893
- https://nvd.nist.gov/vuln/detail/CVE-2024-57893
- https://launchpad.net/bugs/cve/CVE-2024-57893
- https://security-tracker.debian.org/tracker/CVE-2024-57893
- https://ubuntu.com/security/CVE-2024-57893
- https://git.kernel.org/linus/0179488ca992d79908b8e26b9213f1554fc5bacc
Frequently Asked Questions
What is the severity of CVE-2024-57893?
The severity of CVE-2024-57893 is considered moderate due to the potential for race conditions in processing SysEx messages.
How do I fix CVE-2024-57893?
To fix CVE-2024-57893, update your Linux kernel to the latest version where this vulnerability has been resolved.
Which versions of the Linux kernel are affected by CVE-2024-57893?
CVE-2024-57893 affects multiple versions of the Linux kernel that include the OSS sequencer functionality.
What potential impact does CVE-2024-57893 have on system security?
CVE-2024-57893 could lead to unexpected behavior or crashes in the ALSA OSS sequencer when handling SysEx messages.
Is CVE-2024-57893 a local or remote vulnerability?
CVE-2024-57893 is primarily a local vulnerability, affecting users with access to the system that can interact with the ALSA OSS layer.
- agent/title
- agent/severity
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/usn-cve
- source/Ubuntu
- collector/nvd-cve
- collector/launchpad-cve
- source/Launchpad
- agent/description
- agent/references
- agent/source
- agent/softwarecombine
- agent/tags
- agent/event
- collector/security-tracker-debian
- source/Debian
- vendor/linux
- canonical/linux kernel
- package-manager/debian