linux-cve-announce - CVE-2024-38618: ALSA: timer: Set lower bound of start tick time

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024061923-CVE-2024-38618-35a9@gregkh>
Date: Wed, 19 Jun 2024 15:56:31 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-38618: ALSA: timer: Set lower bound of start tick time

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ALSA: timer: Set lower bound of start tick time

Currently ALSA timer doesn't have the lower limit of the start tick
time, and it allows a very small size, e.g. 1 tick with 1ns resolution
for hrtimer.  Such a situation may lead to an unexpected RCU stall,
where  the callback repeatedly queuing the expire update, as reported
by fuzzer.

This patch introduces a sanity check of the timer start tick time, so
that the system returns an error when a too small start size is set.
As of this patch, the lower limit is hard-coded to 100us, which is
small enough but can still work somehow.

The Linux kernel CVE team has assigned CVE-2024-38618 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.19.316 with commit 68396c825c43
	Fixed in 5.4.278 with commit 74bfb8d90f26
	Fixed in 5.10.219 with commit bdd0aa055b8e
	Fixed in 5.15.161 with commit 83f0ba8592b9
	Fixed in 6.1.93 with commit ceab795a67dd
	Fixed in 6.6.33 with commit 2c95241ac5fc
	Fixed in 6.9.3 with commit abb1ad69d98c
	Fixed in 6.10-rc1 with commit 4a63bd179fa8

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-38618
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	sound/core/timer.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/68396c825c43664b20a3a1ba546844deb2b4e48f
	https://git.kernel.org/stable/c/74bfb8d90f2601718ae203faf45a196844c01fa1
	https://git.kernel.org/stable/c/bdd0aa055b8ec7e24bbc19513f3231958741d0ab
	https://git.kernel.org/stable/c/83f0ba8592b9e258fd80ac6486510ab1dcd7ad6e
	https://git.kernel.org/stable/c/ceab795a67dd28dd942d0d8bba648c6c0f7a044b
	https://git.kernel.org/stable/c/2c95241ac5fc90c929d6c0c023e84bf0d30e84c3
	https://git.kernel.org/stable/c/abb1ad69d98cf1ff25bb14fff0e7c3f66239e1cd
	https://git.kernel.org/stable/c/4a63bd179fa8d3fcc44a0d9d71d941ddd62f0c4e