Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs The dreamcastcard->timer could schedule the spu_dma_work and the spu_dma_work could also arm the dreamcastcard->timer. When the snd_pcm_substream is closing, the aica_channel will be deallocated. But it could still be dereferenced in the worker thread. The reason is that del_timer() will return directly regardless of whether the timer handler is running or not and the worker could be rescheduled in the timer handler. As a result, the UAF bug will happen. The racy situation is shown below: (Thread 1) | (Thread 2) snd_aicapcm_pcm_close() | ... | run_spu_dma() //worker | mod_timer() flush_work() | del_timer() | aica_period_elapsed() //timer kfree(dreamcastcard->channel) | schedule_work() | run_spu_dma() //worker ... | dreamcastcard->channel-> //USE In order to mitigate this bug and other possible corner cases, call mod_timer() conditionally in run_spu_dma(), then implement PCM sync_stop op to cancel both the timer and worker. The sync_stop op will be called from PCM core appropriately when needed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
198de43d758ca2700e2b52b49c0b189b4931466c to < eeb2a2ca0b8de7e1c66afaf719529154e7dc60b2affected198de43d758ca2700e2b52b49c0b189b4931466c to < 4206ad65a0ee76920041a755bd3c17c6ba59bba2affected198de43d758ca2700e2b52b49c0b189b4931466c to < aa39e6878f61f50892ee2dd9d2176f72020be845affected198de43d758ca2700e2b52b49c0b189b4931466c to < 8c990221681688da34295d6d76cc2f5b963e83f5affected198de43d758ca2700e2b52b49c0b189b4931466c to < 9d66ae0e7bb78b54e1e0525456c6b54e1d132046affected198de43d758ca2700e2b52b49c0b189b4931466c to < 61d4787692c1fccdc268ffa7a891f9c149f50901affected198de43d758ca2700e2b52b49c0b189b4931466c to < e955e8a7f38a856fc6534ba4e6bffd4d5cc80ac3affected198de43d758ca2700e2b52b49c0b189b4931466c to < 3c907bf56905de7d27b329afaf59c2fb35d17b04affected198de43d758ca2700e2b52b49c0b189b4931466c to < 051e0840ffa8ab25554d6b14b62c9ab9e4901457affected
Linux Linux
Default version status: affected
2.6.23affected0 to < 2.6.23unaffected4.19.312 to ≤ 4.19.*unaffected5.4.274 to ≤ 5.4.*unaffected5.10.215 to ≤ 5.10.*unaffected5.15.154 to ≤ 5.15.*unaffected6.1.84 to ≤ 6.1.*unaffected6.6.24 to ≤ 6.6.*unaffected6.7.12 to ≤ 6.7.*unaffected6.8.3 to ≤ 6.8.*unaffected6.9 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/eeb2a2ca0b8de7e1c66afaf719529154e7dc60b2 ↗
- https://git.kernel.org/stable/c/4206ad65a0ee76920041a755bd3c17c6ba59bba2 ↗
- https://git.kernel.org/stable/c/aa39e6878f61f50892ee2dd9d2176f72020be845 ↗
- https://git.kernel.org/stable/c/8c990221681688da34295d6d76cc2f5b963e83f5 ↗
- https://git.kernel.org/stable/c/9d66ae0e7bb78b54e1e0525456c6b54e1d132046 ↗
- https://git.kernel.org/stable/c/61d4787692c1fccdc268ffa7a891f9c149f50901 ↗
- https://git.kernel.org/stable/c/e955e8a7f38a856fc6534ba4e6bffd4d5cc80ac3 ↗
- https://git.kernel.org/stable/c/3c907bf56905de7d27b329afaf59c2fb35d17b04 ↗
- https://git.kernel.org/stable/c/051e0840ffa8ab25554d6b14b62c9ab9e4901457 ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html ↗