« Volver al listado

CVE-2022-49272

Estado: AnalizadaMedia (5.5)—

In the Linux kernel, the following vulnerability has been resolved:

ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock

syzbot caught a potential deadlock between the PCM runtime->buffer_mutex and the mm->mmap_lock. It was brought by the recent fix to cover the racy read/write and other ioctls, and in that commit, I overlooked a (hopefully only) corner case that may take the revert lock, namely, the OSS mmap. The OSS mmap operation exceptionally allows to re-configure the parameters inside the OSS mmap syscall, where mm->mmap_mutex is already held. Meanwhile, the copy_from/to_user calls at read/write operations also take the mm->mmap_lock internally, hence it may lead to a AB/BA deadlock.

Leer descripción completaMostrar menos

A similar problem was already seen in the past and we fixed it with a refcount (in commit b248371628aa). The former fix covered only the call paths with OSS read/write and OSS ioctls, while we need to cover the concurrent access via both ALSA and OSS APIs now.

This patch addresses the problem above by replacing the buffer_mutex lock in the read/write operations with a refcount similar as we've used for OSS. The new field, runtime->buffer_accessing, keeps the number of concurrent read/write operations. Unlike the former buffer_mutex protection, this protects only around the copy_from/to_user() calls; the other codes are basically protected by the PCM stream lock. The refcount can be a negative, meaning blocked by the ioctls. If a negative value is seen, the read/write aborts with -EBUSY. In the ioctl side, OTOH, they check this refcount, too, and set to a negative value for blocking unless it's already being accessed.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-49272",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "73867cb2bc7dfa7fbd219e53a0b68d253d8fda09",
              "lessThan": "7e9133607e1501c94881be35e118d8f84d96dcb4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b3830197aa7413c65767cf5a1aa8775c83f0dbf7",
              "lessThan": "40f4cffbe13a51faf136faf5f9ef6847782cd595",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "08d1807f097a63ea00a7067dad89c1c81cb2115e",
              "lessThan": "9661bf674d6a82b76e4ae424438a8ce1e3ed855d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "8527c8f052fb42091c6569cb928e472376a4a889",
              "lessThan": "9017201e8d8c6d1472273361389ed431188584a0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "47711ff10c7e126702cfa725f6d86ef529d15a5f",
              "lessThan": "7777744e92a0b30e3e0cce2758d911837011ebd9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "4d1b0ace2d56dc27cc4921eda7fae57f77f03eb5",
              "lessThan": "abedf0d08c79d76da0d6fa0d5dbbc98871dcbc2e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dd2f8c684da3e226e5ec7a81c89ff5fd4a957a03",
              "lessThan": "be9813ad2fc8f0885f5ce6925af0d993ce5da4e5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dca947d4d26dbf925a64a6cfb2ddbc035e831a3d",
              "lessThan": "bc55cfd5718c7c23e5524582e9fa70b4d10f2433",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "include/sound/pcm.h",
            "sound/core/pcm.c",
            "sound/core/pcm_lib.c",
            "sound/core/pcm_native.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10.109",
              "lessThan": "5.10.110",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.15.32",
              "lessThan": "5.15.33",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.16.18",
              "lessThan": "5.16.19",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "5.17.1",
              "lessThan": "5.17.2",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "include/sound/pcm.h",
            "sound/core/pcm.c",
            "sound/core/pcm_lib.c",
            "sound/core/pcm_native.c"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-02-26T07:01:04.097",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/40f4cffbe13a51faf136faf5f9ef6847782cd595",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7777744e92a0b30e3e0cce2758d911837011ebd9",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/7e9133607e1501c94881be35e118d8f84d96dcb4",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9017201e8d8c6d1472273361389ed431188584a0",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9661bf674d6a82b76e4ae424438a8ce1e3ed855d",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/abedf0d08c79d76da0d6fa0d5dbbc98871dcbc2e",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/bc55cfd5718c7c23e5524582e9fa70b4d10f2433",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/be9813ad2fc8f0885f5ce6925af0d993ce5da4e5",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-667"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock\n\nsyzbot caught a potential deadlock between the PCM\nruntime->buffer_mutex and the mm->mmap_lock.  It was brought by the\nrecent fix to cover the racy read/write and other ioctls, and in that\ncommit, I overlooked a (hopefully only) corner case that may take the\nrevert lock, namely, the OSS mmap.  The OSS mmap operation\nexceptionally allows to re-configure the parameters inside the OSS\nmmap syscall, where mm->mmap_mutex is already held.  Meanwhile, the\ncopy_from/to_user calls at read/write operations also take the\nmm->mmap_lock internally, hence it may lead to a AB/BA deadlock.\n\nA similar problem was already seen in the past and we fixed it with a\nrefcount (in commit b248371628aa).  The former fix covered only the\ncall paths with OSS read/write and OSS ioctls, while we need to cover\nthe concurrent access via both ALSA and OSS APIs now.\n\nThis patch addresses the problem above by replacing the buffer_mutex\nlock in the read/write operations with a refcount similar as we've\nused for OSS.  The new field, runtime->buffer_accessing, keeps the\nnumber of concurrent read/write operations.  Unlike the former\nbuffer_mutex protection, this protects only around the\ncopy_from/to_user() calls; the other codes are basically protected by\nthe PCM stream lock.  The refcount can be a negative, meaning blocked\nby the ioctls.  If a negative value is seen, the read/write aborts\nwith -EBUSY.  In the ioctl side, OTOH, they check this refcount, too,\nand set to a negative value for blocking unless it's already being\naccessed."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: pcm: Arreglar un posible bloqueo AB/BA con buffer_mutex y mmap_lock syzbot capturó un posible punto muerto entre PCM runtime->buffer_mutex y mm->mmap_lock. Fue provocado por la corrección reciente para cubrir la lectura/escritura acelerada y otras ioctl, y en esa confirmación, pasé por alto un caso extremo (con suerte el único) que puede tomar el bloqueo de reversión, es decir, el mmap de OSS. La operación mmap de OSS permite excepcionalmente reconfigurar los parámetros dentro de la llamada al sistema mmap de OSS, donde ya se mantiene mm->mmap_mutex. Mientras tanto, las llamadas copy_from/to_user en operaciones de lectura/escritura también toman el mm->mmap_lock internamente, por lo tanto, puede llevar a un punto muerto AB/BA. Ya se vio un problema similar en el pasado y lo arreglamos con un refcount (en el commit b248371628aa). La corrección anterior solo cubría las rutas de llamadas con lectura/escritura de OSS y controles ioctl de OSS, mientras que ahora necesitamos cubrir el acceso concurrente a través de las API de ALSA y OSS. Este parche soluciona el problema anterior al reemplazar el bloqueo buffer_mutex en las operaciones de lectura/escritura con un refcount similar al que hemos usado para OSS. El nuevo campo, runtime->buffer_accessing, mantiene el número de operaciones de lectura/escritura concurrentes. A diferencia de la protección buffer_mutex anterior, esto protege solo alrededor de las llamadas copy_from/to_user(); los otros códigos están básicamente protegidos por el bloqueo de flujo PCM. El refcount puede ser negativo, lo que significa que está bloqueado por los controles ioctl. Si se ve un valor negativo, la lectura/escritura se cancela con -EBUSY. En el lado de los controles ioctl, por otro lado, también verifican este refcount y lo establecen en un valor negativo para bloquear a menos que ya se esté accediendo a él."
    }
  ],
  "lastModified": "2026-06-17T05:17:33.750",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.10.109:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "30B90ABB-06FB-4B7E-A451-DA77D00701C9"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.15.32:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5337E4E3-E37A-4751-A0BC-95BAD5E2C846"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.16.18:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2952A8A8-F546-4638-9C98-C93E3E21F264"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.17.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63D6E310-603B-4734-A44B-AD9C294205E2"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}