In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: timer: don’t re-enter an instance callback that is still running<\/p>\n
The userspace-driven timer (utimer) TRIGGER ioctl calls
\nsnd_timer_interrupt() directly with no serialization, so two threads
\ntriggering the same utimer can run snd_timer_interrupt() on one
\nsnd_timer concurrently.<\/p>\n
snd_timer_process_callbacks() drops timer->lock around each instance
\ncallback and marks the in-flight callback with the single
\nSNDRV_TIMER_IFLG_CALLBACK bit; snd_timer_close_locked() waits on that
\nbit to drain an in-flight callback before freeing the instance. The bit
\ncannot represent two concurrent callbacks: when a second interrupt
\nre-queues an instance whose callback is still running, both run at once,
\nthe first to finish clears the bit, and the close-path drain then frees
\nthe instance (and its callback_data) while the other callback is still
\nlive – a use-after-free reachable by any user able to open
\n\/dev\/snd\/timer, both via a user timer instance and via a sequencer queue
\ntimer bound to the utimer.<\/p>\n
snd_timer_interrupt() sets IFLG_CALLBACK before dropping timer->lock, so
\na concurrent interrupt already observes it under the lock. Skip
\nre-queuing an instance (and its slaves) to the ack\/sack list while its
\ncallback is in flight; the accumulated pticks are delivered on the next
\ntick, so no event is lost.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: timer: don’t re-enter an instance callback that is still running<\/p>\n
The userspace-driven timer (utimer) TRIGGER ioctl calls
\nsnd<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5379","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5379","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5379"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5379"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5379"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}