Bug 1534650

Summary:	kernel: Race condition in ALSA sequencer ioctls may lead to dead lock or use-after-free
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED DUPLICATE	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	agordeev, airlied, ajax, aquini, bhu, blc, bskeggs, dhoward, esammons, ewk, fhrbata, hdegoede, hkrzesin, hwkernel-mgr, iboverma, ichavero, itamar, jarodwilson, jforbes, jglisse, jkacur, john.j5live, jonathan, josef, jross, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, lwang, matt, mchehab, mcressma, mguzik, mjg59, mlangsdo, nmurray, plougher, rt-maint, rvrbovsk, skozina, slawomir, steved, vdronov, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-01-22 15:56:41 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1534652
Bug Blocks:	1534654

Description Adam Mariš 2018-01-15 16:46:39 UTC

It was found that ALSA sequencer ioctls have no protection against racy calls while the concurrent operations may lead to interfere with each other. For example, the concurrent calls of setting client pool with a combination of write calls may lead to either the unkillable dead-lock or UAF.

Upstream patch:

https://github.com/torvalds/linux/commit/b3defb791b26ea0683a93a4f49c77ec45ec96f10

Comment 1 Adam Mariš 2018-01-15 16:49:10 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1534652]

Comment 3 Justin M. Forbes 2018-01-17 12:49:51 UTC

This seems to be the same bug and fix as 1535315

Comment 4 Vladislav Dronov 2018-01-22 15:56:41 UTC

indeed, thanks for noticing. closing this as a duplicate.

*** This bug has been marked as a duplicate of bug 1535315 ***