Описание
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda: trace PCM open only after assigning a stream
Stream assignment can fail when hardware streams are exhausted.
Move the tracepoint after the NULL check because its payload accesses
the assigned stream tag.
Detected by static analysis and reviewed with AI-assisted source auditing.
A flaw was found in the Linux kernel's ALSA (Advanced Linux Sound Architecture) High Definition Audio (HDA) subsystem. A local user can cause a denial of service (DoS) by attempting to open audio streams when hardware streams are exhausted. Because the controller driver invokes an event trace before verifying whether a stream was successfully allocated, it accesses an unassigned stream pointer, leading to a null pointer dereference and a system crash.
Отчет
A low impact denial of service flaw was found in the Linux kernel's ALSA High Definition Audio (HDA) subsystem, affecting the kernel packages in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases built on RHEL CoreOS 9. When a local user attempts to open an ALSA PCM audio stream while all hardware streams are exhausted, the HDA controller driver invokes the trace_azx_pcm_open tracepoint before checking whether a stream was successfully assigned, and the tracepoint payload dereferences the unassigned NULL stream pointer, causing a NULL pointer dereference that crashes the kernel. Red Hat Enterprise Linux 6, 7, and 8 (including their kernel-rt variants) and OpenShift Container Platform 4 releases based on RHEL CoreOS 8 are not affected because the vulnerable code is not present. Although the Red Hat CVSS 3.1 score is 5.5 (moderate), Red Hat rates the impact of this flaw as low because triggering it requires the ALSA HDA tracepoint to be actively enabled, which is not the default configuration, in addition to exhaustion of all available hardware streams. Because of this limited practical exposure, fixes for the affected product streams have been deferred; the residual risk is a local denial of service limited to systems on which HDA tracing has been explicitly enabled.
Меры по смягчению последствий
The vulnerable code path is only reached when the ALSA HDA tracepoint is actively enabled, which is not the default configuration. As a workaround, keep the hda trace_azx_pcm_open tracepoint disabled; avoid enabling ALSA HDA tracing (for example via tracefs) on affected systems, as keeping this tracepoint disabled prevents the NULL pointer dereference. Apart from this workaround, no other mitigation is currently available other than updating to a kernel build that contains the fix once it is released for the affected streams.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by static analysis and reviewed with AI-assisted source auditing.
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by static analysis and reviewed with AI-assisted source auditing.
In the Linux kernel, the following vulnerability has been resolved: A ...
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by static analysis and reviewed with AI-assisted source auditing.
EPSS
5.5 Medium
CVSS3