In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF<\/p>\n
snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer reallocation
\nwith an mmap_count check performed under the PCM stream lock, but the
\nlock is released long before the buffer is actually freed:
\nsnd_pcm_sync_stop(), constraint refinement and do_free_pages() all
\nhappen in between. snd_pcm_mmap_data(), on the other hand, takes no
\nlock at all: it validates against the old buffer’s state and
\ndma_bytes, remaps its pages into the VMA, and only then increments
\nmmap_count.<\/p>\n
A concurrent mmap() can therefore slip in between the check and the
\nfree. remap_pfn_range() installs writable PTEs for the old buffer’s
\npages without taking page references, and the subsequent
\ndo_free_pages() returns those pages to the page allocator while the
\nVMA still maps them. This leaves a stale, writable mapping of freed
\npages: a page-level use-after-free that can be leveraged for local
\nprivilege escalation.<\/p>\n
Make snd_pcm_mmap_data() participate in the buffer-access scheme
\nintroduced for hw_params\/hw_free: acquire runtime->buffer_accessing
\nbefore validating and remapping, and release it afterwards. Buffer
\nreallocation already fails with -EBUSY while accessors are active,
\nand the mmap side now fails with -EBUSY while a reallocation is in
\nprogress, so the validate\/remap sequence and the check\/free sequence
\ncan no longer interleave.<\/p>\n
A reproducer that turns this race into a stale writable mapping of
\nthe freed DMA buffer pages is available on request.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF<\/p>\n
snd_pcm_hw_params() and snd_pcm_hw_free() guard buffer real<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29270","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29270","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29270"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29270"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29270"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}