Описание
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ump: fix double free of out_cvts on rawmidi error
snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array
ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with
kfree() but leaves ump->out_cvts pointing at the freed memory. When the
endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts
a second time, resulting in a double free.
The host snd-usb-audio driver attaches the legacy rawmidi for any USB
MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail
reaches this path on enumeration.
Clear ump->out_cvts after freeing it on the error path so it is not
freed again during teardown.
Discovered by XBOW, triaged by Baul Lee baul.lee@xbow.com
A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Universal MIDI Packet (UMP) driver. This vulnerability, a double free error, occurs when handling legacy raw MIDI (Musical Instrument Digital Interface) conversions. Specifically, an error during the initialization of a USB MIDI 2.0 device can cause memory to be freed twice. This can lead to memory corruption or a system crash, resulting in a Denial of Service (DoS).
Отчет
The ALSA UMP legacy rawmidi initialization path contains a lifetime-management error involving the ump->out_cvts conversion array. snd_ump_attach_legacy_rawmidi() allocates this array before creating the legacy rawmidi device. If snd_rawmidi_new() subsequently fails, the error path frees ump->out_cvts but does not clear the pointer. The UMP endpoint therefore retains a dangling pointer to the freed allocation. When the endpoint is later destroyed, snd_ump_endpoint_free() attempts to free ump->out_cvts again, resulting in a kernel double free.
The host snd-usb-audio driver attaches the legacy rawmidi interface when enumerating USB MIDI 2.0 (UMP) devices, making this error path potentially reachable through a malicious or malformed USB MIDI device that can cause rawmidi initialization to fail. The issue is not network reachable. For CVSS, AV:P reflects that practical exploitation requires physical attachment of a controlled USB MIDI 2.0 device, or an equivalent environment capable of presenting an attacker-controlled USB device to the host.
The confirmed primitive is a kernel double free and the directly supported impact is memory corruption potentially resulting in a kernel crash and denial of service. Public reproductions have demonstrated the invalid second free, although reaching the required snd_rawmidi_new() failure path may depend on specific initialization failures and has also been reproduced using allocation fault injection. No reliable privilege escalation, arbitrary code execution, or attacker-visible information disclosure has been demonstrated.
Меры по смягчению последствий
Prevent the snd-usb-audio kernel module from loading by creating a configuration file in /etc/modprobe.d:
If the module is currently loaded, unload it:
Caveats: This configuration disables all USB sound and USB MIDI devices attached to the host. A system reboot may be required if the module is actively in use and cannot be unloaded immediately.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.2 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of out_cvts on rawmidi error snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with kfree() but leaves ump->out_cvts pointing at the freed memory. When the endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts a second time, resulting in a double free. The host snd-usb-audio driver attaches the legacy rawmidi for any USB MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail reaches this path on enumeration. Clear ump->out_cvts after freeing it on the error path so it is not freed again during teardown. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of out_cvts on rawmidi error snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with kfree() but leaves ump->out_cvts pointing at the freed memory. When the endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts a second time, resulting in a double free. The host snd-usb-audio driver attaches the legacy rawmidi for any USB MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail reaches this path on enumeration. Clear ump->out_cvts after freeing it on the error path so it is not freed again during teardown. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
In the Linux kernel, the following vulnerability has been resolved: A ...
In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: fix double free of out_cvts on rawmidi error snd_ump_attach_legacy_rawmidi() allocates the legacy conversion array ump->out_cvts and, on the snd_rawmidi_new() error path, frees it with kfree() but leaves ump->out_cvts pointing at the freed memory. When the endpoint is later torn down, snd_ump_endpoint_free() frees ump->out_cvts a second time, resulting in a double free. The host snd-usb-audio driver attaches the legacy rawmidi for any USB MIDI 2.0 (UMP) device, so a device that makes snd_rawmidi_new() fail reaches this path on enumeration. Clear ump->out_cvts after freeing it on the error path so it is not freed again during teardown. Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
ELSA-2026-500248: Unbreakable Enterprise kernel security update (IMPORTANT)
EPSS
5.2 Medium
CVSS3