CVE-2024-44954

Summary

In the Linux kernel, the following vulnerability has been resolved:

ALSA: line6: Fix racy access to midibuf

There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by syzkaller below (so put as reported-by here).

This patch protects the midibuf call of the former code path with a spinlock for avoiding the possible races.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux705ececd1c60d0f5d6ef2a719008847883516970 < 643293b68fbb6c03f5e907736498da17d43f0d81affected
LinuxLinux705ececd1c60d0f5d6ef2a719008847883516970 < 40f3d5cb0e0cbf7fa697913a27d5d361373bdcf5affected
LinuxLinux705ececd1c60d0f5d6ef2a719008847883516970 < e7e7d2b180d8f297cea6db43ea72402fd33e1a29affected
LinuxLinux705ececd1c60d0f5d6ef2a719008847883516970 < a54da4b787dcac60b598da69c9c0072812b8282daffected
LinuxLinux705ececd1c60d0f5d6ef2a719008847883516970 < c80f454a805443c274394b1db0d1ebf477abd94eaffected
LinuxLinux705ececd1c60d0f5d6ef2a719008847883516970 < 535df7f896a568a8a1564114eaea49d002cb1747affected
LinuxLinux705ececd1c60d0f5d6ef2a719008847883516970 < 51d87f11dd199bbc6a85982b088ff27bde53b48aaffected
LinuxLinux705ececd1c60d0f5d6ef2a719008847883516970 < 15b7a03205b31bc5623378c190d22b7ff60026f1affected
LinuxLinux2.6.30affected
LinuxLinux0 < 2.6.30unaffected
LinuxLinux4.19.320 <= 4.19.*unaffected
LinuxLinux5.4.282 <= 5.4.*unaffected
LinuxLinux5.10.224 <= 5.10.*unaffected
LinuxLinux5.15.165 <= 5.15.*unaffected
LinuxLinux6.1.105 <= 6.1.*unaffected
LinuxLinux6.6.46 <= 6.6.*unaffected
LinuxLinux6.10.5 <= 6.10.*unaffected
LinuxLinux6.11 <= *unaffected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References