PT-2025-3618 · Linux+7 · Linux Kernel+7
Kun Hu
·
Published
2024-12-03
·
Updated
2026-04-20
·
CVE-2024-57893
CVSS v3.1
6.3
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.6.74
Description
The issue concerns a race condition when processing SysEx messages in the ALSA sequencer OSS layer. The OSS sequencer handles SysEx messages split into 6-byte packets, and the ALSA sequencer OSS layer attempts to combine them, storing data in an internal buffer. This access is racy and may lead to out-of-bounds access.
Recommendations
As a temporary workaround, consider introducing a mutex to serialize the process of SysEx message packets.
Update to Linux kernel version 6.6.74 or later to resolve the issue.
Exploit
Fix
Race Condition
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Linuxmint
Linux Kernel
Red Os
Suse
Ubuntu