Tasos Sahanidis

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to an out of bounds access in the `snd emu10k1 pcm channel alloc()` function. The voice allocator sometimes begins allocating from near the end of the array and then wraps around, however `snd emu10k1 pcm channel alloc()` accesses the newly allocated voices as if it never wrapped around. This results in out of bounds access if the first voice has a high enough index so that `first voice + requested voice count > NUM G (64)`. The more voices are requested, the more likely it is for this to occur. This was initially discovered using PipeWire, however it can be reproduced by calling `aplay` multiple times with 16 channels. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.