CVE-2024-38618

ALSA: timer: Set lower bound of start tick time

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Set lower bound of start tick time Currently ALSA timer doesn't have the lower limit of the start tick time, and it allows a very small size, e.g. 1 tick with 1ns resolution for hrtimer. Such a situation may lead to an unexpected RCU stall, where the callback repeatedly queuing the expire update, as reported by fuzzer. This patch introduces a sanity check of the timer start tick time, so that the system returns an error when a too small start size is set. As of this patch, the lower limit is hard-coded to 100us, which is small enough but can still work somehow.

5.3

CVSS

Severity: Medium

CVSS 3.1 •

EPSS 1.04% Top 25%

Affected: Linux Linux

References

Link	Tags
https://git.kernel.org/stable/c/68396c825c43664b20a3a1ba546844deb2b4e48f
https://git.kernel.org/stable/c/74bfb8d90f2601718ae203faf45a196844c01fa1
https://git.kernel.org/stable/c/bdd0aa055b8ec7e24bbc19513f3231958741d0ab
https://git.kernel.org/stable/c/83f0ba8592b9e258fd80ac6486510ab1dcd7ad6e
https://git.kernel.org/stable/c/ceab795a67dd28dd942d0d8bba648c6c0f7a044b
https://git.kernel.org/stable/c/2c95241ac5fc90c929d6c0c023e84bf0d30e84c3
https://git.kernel.org/stable/c/abb1ad69d98cf1ff25bb14fff0e7c3f66239e1cd
https://git.kernel.org/stable/c/4a63bd179fa8d3fcc44a0d9d71d941ddd62f0c4e

Frequently Asked Questions

What is the severity of CVE-2024-38618?: CVE-2024-38618 has been scored as a medium severity vulnerability.
How to fix CVE-2024-38618?: To fix CVE-2024-38618, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-38618 being actively exploited in the wild?: It is possible that CVE-2024-38618 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~1% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-38618?: CVE-2024-38618 affects Linux Linux, Linux Linux.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.