Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 1 Dec 2020 13:51:58 +0800
From: butt3rflyh4ck <>
Subject: Linux Kernel: ALSA: use-after-free Write in snd_rawmidi_kernel_write1

I reported a use-after-free bug in snd_rawmidi_kernel_write1 in
sound/core/rawmidi.c months ago. And I reproduced it in the latest version
linux-5.7.0 at that time.


It was found that the raw midi kernel driver does not protect
against concurrent access which leads to a use-after-free in
snd_rawmidi_kernel_read1() and snd_rawmidi_kernel_write1() in rawmidi.c
A malicious local attacker could possibly use this for privilege

Root Cause:

The rawmidi core allows user to resize the runtime buffer via ioctl,
and this may lead to UAF when performed during concurrent reads or writes:
the read/write functions unlock the runtime lock temporarily during copying
form/to user-space,
and that's the race window.

Patch for this issue:

CVE assigned:

not assigned.


*2020/5/7  - Vulnerability reported to
*2020/5/7  - Vulnerability confirmed and patched.
*2020/5/18 - Request a CVE ID via
*2020/11/18 - CVE Request responded but not assigned.
*2020/11/18 - Reported to Red Hat.
*2020/12/1 - Opened on oss


This issue was discovered by the ADLab of venustech.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.