linux-cve-announce - CVE-2025-38078: ALSA: pcm: Fix race of buffer access at PCM OSS layer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025061841-CVE-2025-38078-3f10@gregkh>
Date: Wed, 18 Jun 2025 11:34:13 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-38078: ALSA: pcm: Fix race of buffer access at PCM OSS layer

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: Fix race of buffer access at PCM OSS layer

The PCM OSS layer tries to clear the buffer with the silence data at
initialization (or reconfiguration) of a stream with the explicit call
of snd_pcm_format_set_silence() with runtime->dma_area.  But this may
lead to a UAF because the accessed runtime->dma_area might be freed
concurrently, as it's performed outside the PCM ops.

For avoiding it, move the code into the PCM core and perform it inside
the buffer access lock, so that it won't be changed during the
operation.

The Linux kernel CVE team has assigned CVE-2025-38078 to this issue.


Affected and fixed versions
===========================

	Fixed in 5.4.294 with commit c0e05a76fc727929524ef24a19c302e6dd40233f
	Fixed in 5.10.238 with commit 8170d8ec4efd0be352c14cb61f374e30fb0c2a25
	Fixed in 5.15.185 with commit 10217da9644ae75cea7330f902c35fc5ba78bbbf
	Fixed in 6.1.141 with commit f3e14d706ec18faf19f5a6e75060e140fea05d4a
	Fixed in 6.6.93 with commit 74d90875f3d43f3eff0e9861c4701418795d3455
	Fixed in 6.12.31 with commit bf85e49aaf3a3c5775ea87369ea5f159c2148db4
	Fixed in 6.14.9 with commit afa56c960fcb4db37f2e3399f28e9402e4e1f470
	Fixed in 6.15 with commit 93a81ca0657758b607c3f4ba889ae806be9beb73

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-38078
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/sound/pcm.h
	sound/core/oss/pcm_oss.c
	sound/core/pcm_native.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/c0e05a76fc727929524ef24a19c302e6dd40233f
	https://git.kernel.org/stable/c/8170d8ec4efd0be352c14cb61f374e30fb0c2a25
	https://git.kernel.org/stable/c/10217da9644ae75cea7330f902c35fc5ba78bbbf
	https://git.kernel.org/stable/c/f3e14d706ec18faf19f5a6e75060e140fea05d4a
	https://git.kernel.org/stable/c/74d90875f3d43f3eff0e9861c4701418795d3455
	https://git.kernel.org/stable/c/bf85e49aaf3a3c5775ea87369ea5f159c2148db4
	https://git.kernel.org/stable/c/afa56c960fcb4db37f2e3399f28e9402e4e1f470
	https://git.kernel.org/stable/c/93a81ca0657758b607c3f4ba889ae806be9beb73