In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: seq: Serialize UMP output teardown with event_input<\/p>\n
seq_ump_process_event() borrows client->out_rfile.output without
\nsynchronizing with the first-open and last-close transition in
\nseq_ump_client_open() and seq_ump_client_close().<\/p>\n
The last output unuse can therefore drop opened[STR_OUT] to zero and
\nrelease the rawmidi file while an in-flight event_input callback is still
\ninside snd_rawmidi_kernel_write(). That leaves the rawmidi substream
\nruntime exposed to teardown before the write path has taken its own
\nbuffer reference.<\/p>\n
Add a per-client rwlock for the event_input-visible output file. Publish
\na newly opened output file under the write side, and hold the read side
\nfrom the output lookup through snd_rawmidi_kernel_write(). The last
\noutput close copies and clears the visible output file under the write
\nside, then drops the lock and releases the saved rawmidi file. Use
\nIRQ-safe rwlock guards because event_input can also be reached from
\natomic sequencer delivery.<\/p>\n
The buggy scenario involves two paths, with each column showing the
\norder within that path:<\/p>\n
path A label: event_input path path B label: last unuse path
\n1. seq_ump_process_event() reads 1. seq_ump_client_close()
\n client->out_rfile.output. drops opened[STR_OUT] to zero.
\n2. snd_rawmidi_kernel_write1() 2. snd_rawmidi_kernel_release()
\n has not yet pinned runtime. closes the output file.
\n3. The writer continues using 3. close_substream() frees
\n the borrowed substream. substream->runtime.<\/p>\n
This keeps the output substream and runtime alive for the full
\nevent_input write while keeping rawmidi release outside the rwlock.<\/p>\n
KASAN reproduced this as a slab-use-after-free in
\nsnd_rawmidi_kernel_write1(), with allocation through
\nseq_ump_use()\/snd_seq_port_connect() and free through
\nseq_ump_unuse()\/snd_seq_port_disconnect().<\/p>\n
Validation reproduced this kernel report:
\nKASAN slab-use-after-free in snd_rawmidi_kernel_write1+0x9d\/0x400
\nRIP: 0033:0x7f5528af837f
\nRead of size 8
\nCall trace:
\n dump_stack_lvl+0x73\/0xb0 (?:?)
\n print_report+0xd1\/0x650 (?:?)
\n srso_alias_return_thunk+0x5\/0xfbef5 (?:?)
\n __virt_addr_valid+0x1a7\/0x340 (?:?)
\n kasan_complete_mode_report_info+0x64\/0x200 (?:?)
\n kasan_report+0xf7\/0x130 (?:?)
\n snd_rawmidi_kernel_write1+0x9d\/0x400 (?:?)
\n __asan_load8+0x82\/0xb0 (?:?)
\n update_stack_state+0x1ef\/0x2d0 (?:?)
\n snd_rawmidi_kernel_write+0x1a\/0x20 (?:?)
\n seq_ump_process_event+0xd4\/0x120 (sound\/core\/seq\/seq_ump_client.c:82)
\n __snd_seq_deliver_single_event+0x8a\/0xe0 (?:?)
\n snd_seq_deliver_from_ump+0x2b2\/0xd60 (?:?)
\n lock_acquire+0x14e\/0x2e0 (?:?)
\n find_held_lock+0x31\/0x90 (?:?)
\n snd_seq_port_use_ptr+0xa6\/0xe0 (?:?)
\n __kasan_check_write+0x18\/0x20 (?:?)
\n do_raw_read_unlock+0x32\/0xa0 (?:?)
\n _raw_read_unlock+0x26\/0x50 (?:?)
\n snd_seq_deliver_single_event+0x45c\/0x4b0 (?:?)
\n snd_seq_deliver_event+0x10d\/0x1b0 (?:?)
\n snd_seq_client_enqueue_event+0x192\/0x240 (?:?)
\n snd_seq_write+0x2cd\/0x450 (?:?)
\n apparmor_file_permission+0x20\/0x30 (?:?)
\n security_file_permission+0x51\/0x60 (?:?)
\n vfs_write+0x1ce\/0x850 (?:?)
\n __fget_files+0x12b\/0x220 (?:?)
\n lock_release+0xc8\/0x2a0 (?:?)
\n __rcu_read_unlock+0x74\/0x2d0 (?:?)
\n __fget_files+0x135\/0x220 (?:?)
\n ksys_write+0x15a\/0x180 (?:?)
\n rcu_is_watching+0x24\/0x60 (?:?)
\n __x64_sys_write+0x46\/0x60 (?:?)
\n x64_sys_call+0x7d\/0x20d0 (?:?)
\n do_syscall_64+0xc1\/0x360 (arch\/x86\/entry\/syscall_64.c:87)
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f (?:?)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: seq: Serialize UMP output teardown with event_input<\/p>\n
seq_ump_process_event() borrows client->out_rfile.output without
\nsynchro<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15021","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15021","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15021"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15021"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15021"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}