Bug 2360244 (CVE-2025-23134) - CVE-2025-23134 kernel: ALSA: timer: Don't take register_mutex with copy_from/to_user()
Summary: CVE-2025-23134 kernel: ALSA: timer: Don't take register_mutex with copy_from/...
Keywords:
Status: NEW
Alias: CVE-2025-23134
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-04-16 15:04 UTC by OSIDB Bzimport
Modified: 2025-04-17 12:36 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2025-04-16 15:04:21 UTC
In the Linux kernel, the following vulnerability has been resolved:

ALSA: timer: Don't take register_mutex with copy_from/to_user()

The infamous mmap_lock taken in copy_from/to_user() can be often
problematic when it's called inside another mutex, as they might lead
to deadlocks.

In the case of ALSA timer code, the bad pattern is with
guard(mutex)(&register_mutex) that covers copy_from/to_user() -- which
was mistakenly introduced at converting to guard(), and it had been
carefully worked around in the past.

This patch fixes those pieces simply by moving copy_from/to_user() out
of the register mutex lock again.

Comment 1 Avinash Hanwate 2025-04-17 10:58:01 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2025041632-CVE-2025-23134-22f8@gregkh/T


Note You need to log in before you can comment on or make changes to this bug.