In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: bcd2000: clear the URB pointers on disconnect<\/p>\n
bcd2000_free_usb_related_resources() frees both URBs and leaves the
\npointers behind:<\/p>\n
\tusb_kill_urb(bcd2k->midi_out_urb);
\n\tusb_kill_urb(bcd2k->midi_in_urb);<\/p>\n
\tusb_free_urb(bcd2k->midi_out_urb);
\n\tusb_free_urb(bcd2k->midi_in_urb);<\/p>\n
The rawmidi device outlives that call. A substream that is still open
\nwhen the device is unplugged reaches bcd2000_midi_send() from the
\ntrigger path on close. That function writes to the freed URB and then
\nhands it to the USB core:<\/p>\n
\tbcd2k->midi_out_urb->transfer_buffer_length = BUFSIZE;
\n\t…
\n\tret = usb_submit_urb(bcd2k->midi_out_urb, GFP_ATOMIC);<\/p>\n
usb_kill_urb() does not stop a later submission either, so a submit that
\nraces the disconnect can requeue the URB after it has been reaped.
\nmidi_in_urb is exposed the same way: bcd2000_input_complete() resubmits
\nit from the completion handler.<\/p>\n
KASAN on 7.2.0-rc5 (arm64):<\/p>\n
BUG: KASAN: slab-use-after-free in bcd2000_midi_send [snd_bcd2000]
\n Write of size 4 at addr ffff00001827d388 by task bpoc\/168
\n __asan_store4
\n bcd2000_midi_send [snd_bcd2000]
\n bcd2000_midi_output_trigger [snd_bcd2000]
\n snd_rawmidi_kernel_write1
\n close_substream.part.0
\n Freed by task 168:
\n usb_free_urb
\n bcd2000_disconnect [snd_bcd2000]<\/p>\n
BUG: KASAN: slab-use-after-free in usb_submit_urb
\n Read of size 8 at addr ffff00001827d3b8 by task bpoc\/168<\/p>\n
Clear both pointers after freeing and test them on the paths that can
\nstill run. Poison the URBs before freeing them: usb_poison_urb() waits
\nfor a running completion handler and rejects any later submission, so
\nafter it returns the input path is quiesced and only the rawmidi trigger
\npath can still reach bcd2000_midi_send(). No unpoison is needed; the
\nURBs are freed on the next line.<\/p>\n
Discovered by XBOW, triaged by Baul Lee <\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: bcd2000: clear the URB pointers on disconnect<\/p>\n
bcd2000_free_usb_related_resources() frees both URBs and leaves the
\npointers b<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21304","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21304","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21304"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21304"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21304"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}