ALSA: pcm: oss: Limit the period size to 16MB
Summary
GSD-2021-1002407: ALSA: pcm: oss: Limit the period size to 16MB. Affects Kernel versions < be55f306396cd62c6889286a7194fd8b53363aeb. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The ALSA (Advanced Linux Sound Architecture) package is responsible for providing audio and MIDI functionality to the Linux operating system. It is a software framework that enables sound card drivers and sound servers to communicate with audio devices. ALSA supports a wide range of sound cards and audio devices, allowing users to play and record audio on their Linux systems. However, a vulnerability has been discovered in the ALSA pcm oss module, which could potentially be exploited by attackers to cause a denial of service or execute arbitrary code on affected systems.
Vulnerability Detail
The vulnerability in the ALSA pcm oss module allows an attacker to manipulate the period size of the audio buffer, potentially leading to a buffer overflow. By sending specially crafted audio data to the affected system, an attacker could trigger this vulnerability and cause the system to crash or execute arbitrary code. The period size is limited to 16MB in the fixed version of the Linux Kernel, preventing the buffer overflow from occurring. It is important to note that the impact and attack plausibility of this vulnerability have not been proven yet.
How To Fix
No fixed version is published for this vulnerability.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.14.258 or later. This update includes the commit be55f306396cd62c6889286a7194fd8b53363aeb, which limits the period size to 16MB in the ALSA pcm oss module. Updating the Linux Kernel ensures that the vulnerability is patched and mitigates the risk of exploitation.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The ALSA pcm oss module vulnerability can be mitigated by updating the Linux Kernel to version v4.14.258 or later. This update limits the period size to 16MB, preventing potential buffer overflows. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ALSA (Advanced Linux Sound Architecture) is a software framework that provides audio and MIDI functionality to the Linux operating system. It enables sound card drivers and sound servers to communicate with audio devices, allowing users to play and record audio on their Linux systems.
The ALSA pcm oss module is a component of the ALSA package that provides compatibility with the OSS (Open Sound System) API. It allows applications that use the OSS API to work with the ALSA sound system.
A buffer overflow is a type of software vulnerability where an attacker can overwrite data in a buffer beyond its allocated boundaries. This can lead to crashes, privilege escalation, or arbitrary code execution.
The impact of this vulnerability could range from a denial of service, where the system crashes or becomes unresponsive, to arbitrary code execution, where an attacker can execute malicious code on the affected system.
You can use Vulert's playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Vulert uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in the software, without requiring access to the code or installation.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.