ALSA: timer: don't re-enter an instance callback that is still running
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.12.101, 6.18.42, 7.1.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: don't re-enter an instance callback that is still running The userspace-driven timer (utimer) TRIGGER ioctl calls snd_timer_interrupt() directly with no serialization, so two threads triggering the same utimer can run snd_timer_interrupt() on one snd_timer concurrently. snd_timer_process_callbacks() drops timer->lock around each instance callback and marks the in-flight callback with the single SNDRV_TIMER_IFLG_CALLBACK bit; snd_timer_close_locked() waits on that bit to drain an in-flight callback before freeing the instance. The bit cannot represent two concurrent callbacks: when a second interrupt re-queues an instance whose callback is still running, both run at once, the first to finish clears the bit, and the close-path drain then frees the instance (and its callback_data) while the other callback is still live - a use-after-free reachable by any user able to open /dev/snd/timer, both via a user timer instance and via a sequencer queue timer bound to the utimer. snd_timer_interrupt() sets IFLG_CALLBACK before dropping timer->lock, so a concurrent interrupt already observes it under the lock. Skip re-queuing an instance (and its slaves) to the ack/sack list while its callback is in flight; the accumulated pticks are delivered on the next tick, so no event is lost.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- Linux Linux
From 37745918e0e7575bc40f38da93a99b9fa6406224 · fixed in 996c24377eea4d4506b7c3ccbbf1e490440b5e0b; From 37745918e0e7575bc40f38da93a99b9fa6406224 · fixed in 1395327a96614885552bae5fbb650e6dd182d49b; From 37745918e0e7575bc40f38da93a99b9fa6406224 · fixed in c1078130a4cd7e738f4b73afe99b3e68cbfbf884; From 37745918e0e7575bc40f38da93a99b9fa6406224 · fixed in 70d28bfcd6224eed75986b3b987b997e59643fa4
- Linux Linux
6.12
- KernelLinux
From 6.12.0 · fixed in 6.12.101; From 6.13.0 · fixed in 6.18.42; From 6.19.0 · fixed in 7.1.6