| { |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" |
| }, |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock\n\nsyzbot caught a potential deadlock between the PCM\nruntime->buffer_mutex and the mm->mmap_lock. It was brought by the\nrecent fix to cover the racy read/write and other ioctls, and in that\ncommit, I overlooked a (hopefully only) corner case that may take the\nrevert lock, namely, the OSS mmap. The OSS mmap operation\nexceptionally allows to re-configure the parameters inside the OSS\nmmap syscall, where mm->mmap_mutex is already held. Meanwhile, the\ncopy_from/to_user calls at read/write operations also take the\nmm->mmap_lock internally, hence it may lead to a AB/BA deadlock.\n\nA similar problem was already seen in the past and we fixed it with a\nrefcount (in commit b248371628aa). The former fix covered only the\ncall paths with OSS read/write and OSS ioctls, while we need to cover\nthe concurrent access via both ALSA and OSS APIs now.\n\nThis patch addresses the problem above by replacing the buffer_mutex\nlock in the read/write operations with a refcount similar as we've\nused for OSS. The new field, runtime->buffer_accessing, keeps the\nnumber of concurrent read/write operations. Unlike the former\nbuffer_mutex protection, this protects only around the\ncopy_from/to_user() calls; the other codes are basically protected by\nthe PCM stream lock. The refcount can be a negative, meaning blocked\nby the ioctls. If a negative value is seen, the read/write aborts\nwith -EBUSY. In the ioctl side, OTOH, they check this refcount, too,\nand set to a negative value for blocking unless it's already being\naccessed." |
| } |
| ], |
| "affected": [ |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "include/sound/pcm.h", |
| "sound/core/pcm.c", |
| "sound/core/pcm_lib.c", |
| "sound/core/pcm_native.c" |
| ], |
| "versions": [ |
| { |
| "version": "73867cb2bc7dfa7fbd219e53a0b68d253d8fda09", |
| "lessThan": "7e9133607e1501c94881be35e118d8f84d96dcb4", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "b3830197aa7413c65767cf5a1aa8775c83f0dbf7", |
| "lessThan": "40f4cffbe13a51faf136faf5f9ef6847782cd595", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "08d1807f097a63ea00a7067dad89c1c81cb2115e", |
| "lessThan": "9661bf674d6a82b76e4ae424438a8ce1e3ed855d", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "8527c8f052fb42091c6569cb928e472376a4a889", |
| "lessThan": "9017201e8d8c6d1472273361389ed431188584a0", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "47711ff10c7e126702cfa725f6d86ef529d15a5f", |
| "lessThan": "7777744e92a0b30e3e0cce2758d911837011ebd9", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "4d1b0ace2d56dc27cc4921eda7fae57f77f03eb5", |
| "lessThan": "abedf0d08c79d76da0d6fa0d5dbbc98871dcbc2e", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "dd2f8c684da3e226e5ec7a81c89ff5fd4a957a03", |
| "lessThan": "be9813ad2fc8f0885f5ce6925af0d993ce5da4e5", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "dca947d4d26dbf925a64a6cfb2ddbc035e831a3d", |
| "lessThan": "bc55cfd5718c7c23e5524582e9fa70b4d10f2433", |
| "status": "affected", |
| "versionType": "git" |
| } |
| ] |
| }, |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "include/sound/pcm.h", |
| "sound/core/pcm.c", |
| "sound/core/pcm_lib.c", |
| "sound/core/pcm_native.c" |
| ], |
| "versions": [ |
| { |
| "version": "5.10.109", |
| "lessThan": "5.10.110", |
| "status": "affected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.15.32", |
| "lessThan": "5.15.33", |
| "status": "affected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.16.18", |
| "lessThan": "5.16.19", |
| "status": "affected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.17.1", |
| "lessThan": "5.17.2", |
| "status": "affected", |
| "versionType": "semver" |
| } |
| ] |
| } |
| ], |
| "cpeApplicability": [ |
| { |
| "nodes": [ |
| { |
| "operator": "OR", |
| "negate": false, |
| "cpeMatch": [ |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.10.109", |
| "versionEndExcluding": "5.10.110" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.15.32", |
| "versionEndExcluding": "5.15.33" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.16.18", |
| "versionEndExcluding": "5.16.19" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.17.1", |
| "versionEndExcluding": "5.17.2" |
| } |
| ] |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://git.kernel.org/stable/c/7e9133607e1501c94881be35e118d8f84d96dcb4" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/40f4cffbe13a51faf136faf5f9ef6847782cd595" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/9661bf674d6a82b76e4ae424438a8ce1e3ed855d" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/9017201e8d8c6d1472273361389ed431188584a0" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/7777744e92a0b30e3e0cce2758d911837011ebd9" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/abedf0d08c79d76da0d6fa0d5dbbc98871dcbc2e" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/be9813ad2fc8f0885f5ce6925af0d993ce5da4e5" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/bc55cfd5718c7c23e5524582e9fa70b4d10f2433" |
| } |
| ], |
| "title": "ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock", |
| "x_generator": { |
| "engine": "bippy-1.2.0" |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", |
| "cveID": "CVE-2022-49272", |
| "requesterUserId": "gregkh@kernel.org", |
| "serial": "1", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0" |
| } |
