In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: pcm: set timer->private_data before registering the PCM timer<\/p>\n
snd_pcm_timer_init() calls snd_device_register() to link the new
\nstruct snd_timer into the global timer list while it still carries
\nhw.c_resolution = snd_pcm_timer_resolution (and hw.start\/hw.stop),
\nand only afterwards sets timer->private_data = substream.<\/p>\n
Once the timer is on the list under register_mutex, a concurrent
\nreader can already reach it through the same mutex and invoke these
\ncallbacks. \/proc\/asound\/timers does this via c_resolution(), and
\nsnd_timer_open()+snd_timer_start() reach start()\/stop() the same way.
\nAll three dereference timer->private_data, which for this brief
\nwindow is NULL, giving a NULL-pointer dereference:<\/p>\n
substream = timer->private_data;
\n return substream->runtime ? … \/\/ substream is NULL<\/p>\n
Move the private_data\/private_free assignment before
\nsnd_device_register() so the timer is never visible on the list
\nwithout its private_data set. On the snd_device_register() failure
\npath, private_free() (snd_pcm_timer_free()) can now run, but it only
\ndoes substream->timer = NULL, which is already NULL at that point
\nsince substream->timer is set to the new timer just once, after a
\nsuccessful registration — so the failure path stays safe.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: pcm: set timer->private_data before registering the PCM timer<\/p>\n
snd_pcm_timer_init() calls snd_device_register() to link the n<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33383","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33383","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33383"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33383"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33383"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}