In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Fix racy access to midibuf There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by syzkaller below (so put as reported-by here). This patch protects the midibuf call of the former code path with a spinlock for avoiding the possible races.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*

No data.

References
Link Providers
https://git.kernel.org/stable/c/15b7a03205b31bc5623378c190d22b7ff60026f1 cve-icon cve-icon
https://git.kernel.org/stable/c/40f3d5cb0e0cbf7fa697913a27d5d361373bdcf5 cve-icon cve-icon
https://git.kernel.org/stable/c/51d87f11dd199bbc6a85982b088ff27bde53b48a cve-icon cve-icon
https://git.kernel.org/stable/c/535df7f896a568a8a1564114eaea49d002cb1747 cve-icon cve-icon
https://git.kernel.org/stable/c/643293b68fbb6c03f5e907736498da17d43f0d81 cve-icon cve-icon
https://git.kernel.org/stable/c/a54da4b787dcac60b598da69c9c0072812b8282d cve-icon cve-icon
https://git.kernel.org/stable/c/c80f454a805443c274394b1db0d1ebf477abd94e cve-icon cve-icon
https://git.kernel.org/stable/c/e7e7d2b180d8f297cea6db43ea72402fd33e1a29 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2024090411-CVE-2024-44954-6838@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2024-44954 cve-icon
https://www.cve.org/CVERecord?id=CVE-2024-44954 cve-icon
History

Thu, 10 Oct 2024 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
Metrics cvssV3_1

{'score': 5.0, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Wed, 09 Oct 2024 14:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 5.0, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H'}

Wed, 11 Sep 2024 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 04 Sep 2024 23:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 04 Sep 2024 18:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Fix racy access to midibuf There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warning triggered by syzkaller below (so put as reported-by here). This patch protects the midibuf call of the former code path with a spinlock for avoiding the possible races.
Title ALSA: line6: Fix racy access to midibuf
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-09-04T18:35:53.730Z

Updated: 2024-11-05T09:42:52.028Z

Reserved: 2024-08-21T05:34:56.666Z

Link: CVE-2024-44954

cve-icon Vulnrichment

Updated: 2024-09-11T12:42:24.811Z

cve-icon NVD

Status : Analyzed

Published: 2024-09-04T19:15:30.353

Modified: 2024-10-10T18:02:42.307

Link: CVE-2024-44954

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-09-04T00:00:00Z

Links: CVE-2024-44954 - Bugzilla