CVE-2024-26654 ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
A use-after-free vulnerability in the Linux kernel's ALSA SH AICA driver allows attackers to execute arbitrary code or escalate privileges via race conditions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-26654?
CVE-2024-26654 is a high-severity use after free vulnerability in Debian Debian Linux, published on 1 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs
The dreamcastcard->timer could schedule the spu_dma_work and the spu_dma_work could also arm the dreamcastcard->timer.
When the snd_pcm_substream is closing, the aica_channel will be deallocated. But it could still be dereferenced in the worker thread. The reason is that del_timer() will return directly regardless of whether the timer handler is running or not and the worker could be rescheduled in the timer handler. As a result, the UAF bug will happen. The racy situation is shown below:
(Thread 1) | (Thread 2) snd_aicapcm_pcm_close() | ... | run_spu_dma() //worker | mod_timer() flush_work() | del_timer() | aica_period_elapsed() //timer kfree(dreamcastcard->channel) | schedule_work() | run_spu_dma() //worker ... | dreamcastcard->channel-> //USE
In order to mitigate this bug and other possible corner cases, call mod_timer() conditionally in run_spu_dma(), then implement PCM sync_stop op to cancel both the timer and worker. The sync_stop op will be called from PCM core appropriately when needed.
Weakness: CWE-416
Which versions are affected by CVE-2024-26654?
It affects 2 products.
Products include Debian Debian Linux, Linux kernel.
How do I fix CVE-2024-26654?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2024-26654 being exploited?
There is no known exploitation of CVE-2024-26654 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BELL-CVE-2024-26654, DEBIAN-CVE-2024-26654, GHSA-pgc5-vrj2-c9w5, UBUNTU-CVE-2024-26654.