Messages in this thread | | | Date | Fri, 13 Jan 2023 13:44:45 +0100 | Subject | Re: [PATCH] ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF | From | Jaroslav Kysela <> |
| |
On 13. 01. 23 13:07, Takashi Iwai wrote: > From: Clement Lecigne <clecigne@google.com> > > Takes rwsem lock inside snd_ctl_elem_read instead of snd_ctl_elem_read_user > like it was done for write in commit 1fa4445f9adf1 ("ALSA: control - introduce > snd_ctl_notify_one() helper"). Doing this way we are also fixing the following > locking issue happening in the compat path which can be easily triggered and > turned into an use-after-free. > > 64-bits: > snd_ctl_ioctl > snd_ctl_elem_read_user > [takes controls_rwsem] > snd_ctl_elem_read [lock properly held, all good] > [drops controls_rwsem] > > 32-bits: > snd_ctl_ioctl_compat > snd_ctl_elem_write_read_compat > ctl_elem_write_read > snd_ctl_elem_read [missing lock, not good] > > CVE-2023-0266 was assigned for this issue. > > Cc: stable@kernel.org # 5.13+ > Signed-off-by: Clement Lecigne <clecigne@google.com> > Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
-- Jaroslav Kysela <perex@perex.cz> Linux Sound Maintainer; ALSA Project; Red Hat, Inc.
| |