ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
Summary
GSD-2022-1001938: ALSA: pcm: Fix races among concurrent hw_params and hw_free calls. Affects Kernel versions < 33061d0fba51d2bf70a2ef9645f703c33fe8e438. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The ALSA (Advanced Linux Sound Architecture) package is responsible for providing audio functionality in the Linux kernel. It includes drivers, libraries, and utilities for audio devices. The pcm component of ALSA handles the PCM (Pulse Code Modulation) audio data, which is the standard format for digital audio in computers and other digital audio devices. PCM data is processed by ALSA's pcm subsystem, which includes functions like hw_params and hw_free.
Vulnerability Detail
The vulnerability in ALSA's pcm subsystem involves races that can occur when multiple processes or threads concurrently call the hw_params and hw_free functions. These functions are used to configure and release hardware parameters for PCM audio data. The races can lead to inconsistent or corrupted state, potentially resulting in various issues such as crashes, data corruption, or privilege escalation. The vulnerability has been fixed in Linux Kernel version v5.15.32 by commit 33061d0fba51d2bf70a2ef9645f703c33fe8e438.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The ALSA pcm subsystem in the Linux Kernel prior to version v5.15.32 is vulnerable to races among concurrent hw_params and hw_free calls. This can lead to various issues, including crashes, data corruption, or privilege escalation. It is recommended to update the Linux Kernel to version v5.15.32 or later to fix the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ALSA (Advanced Linux Sound Architecture) is a software framework and part of the Linux kernel that provides audio functionality for Linux-based systems.
PCM (Pulse Code Modulation) is a digital representation of analog audio signals. It is the standard format for digital audio in computers and other digital audio devices.
The hw_params function is used to configure hardware parameters for PCM audio data, such as sample rate, number of channels, and data format.
The hw_free function is used to release hardware resources and reset the state of the PCM audio subsystem.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
