ALSA: ump: do not touch legacy_rmidi before it exists
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.158, 6.12.111, 6.18.53, 7.2.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacy_rmidi before it exists snd_ump_parse_endpoint() sets ump->parsed on every exit, including error, before the caller attaches the legacy rawmidi device. ump_handle_ep_name_msg() then treats parsed as "legacy_rmidi is live" and calls ump_legacy_set_rawmidi_name(), which snprintf()s into ump->legacy_rmidi->name. If a UMP packet arrives in that window (IRQ path from snd_ump_receive), legacy_rmidi is still NULL (KASAN null-ptr-deref in snprintf). Guard the legacy helpers. parsed only means endpoint info was parsed, not that legacy_rmidi exists.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 37e0e14128e0685267dc5c037bf655421a6ce2ea · fixed in d6f9af093dc91dac8848a01e417b8109c651c0b2; From 37e0e14128e0685267dc5c037bf655421a6ce2ea · fixed in 1c8e01792adf91879322f1ad752f1814de8b7e7d; From 37e0e14128e0685267dc5c037bf655421a6ce2ea · fixed in 228075f31b141395233218712242913125ace4e0; From 37e0e14128e0685267dc5c037bf655421a6ce2ea · fixed in a4cef20cd473e0640fefd38094d4baac0ec76ae3; From 37e0e14128e0685267dc5c037bf655421a6ce2ea · fixed in adeee7187694719890aaffdc14b7e89cfd736f1d
- Linux Linux
6.5
- KernelLinux
From 6.5.0 · fixed in 6.6.158; From 6.7.0 · fixed in 6.12.111; From 6.13.0 · fixed in 6.18.53; From 6.19.0 · fixed in 7.2.7