6.3

CVE-2024-57893

ALSA: seq: oss: Fix races at processing SysEx messages

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: oss: Fix races at processing SysEx messages

OSS sequencer handles the SysEx messages split in 6 bytes packets, and
ALSA sequencer OSS layer tries to combine those.  It stores the data
in the internal buffer and this access is racy as of now, which may
lead to the out-of-bounds access.

As a temporary band-aid fix, introduce a mutex for serializing the
process of the SysEx message packets.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version < 6.1.124
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.70
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.9
Linux ≫ Linux Kernel Version6.13 Updaterc1
Linux ≫ Linux Kernel Version6.13 Updaterc2
Linux ≫ Linux Kernel Version6.13 Updaterc3
Linux ≫ Linux Kernel Version6.13 Updaterc4
Linux ≫ Linux Kernel Version6.13 Updaterc5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.054
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.3 1 5.2
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

https://git.kernel.org/stable/c/0179488ca992d79908b8e26b9213f1554fc5bacc
Patch
https://git.kernel.org/stable/c/9d382112b36382aa65aad765f189ebde9926c101
Patch
https://git.kernel.org/stable/c/cff1de87ed14fc0f2332213d2367100e7ad0753a
Patch
https://git.kernel.org/stable/c/d2392b79d8af3714ea8878b71c66dc49d3110f44
Patch
https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html