Log in Start free

Vulnerability · Published Jan 15, 2025 · Assigned by Linux

CVE-2024-57893ALSA: seq: oss: Fix races at processing SysEx messages

High 7.8

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 92.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix races at processing SysEx messages OSS sequencer handles the SysEx messages split in 6 bytes packets, and ALSA sequencer OSS layer tries to combine those. It stores the data in the internal buffer and this access is racy as of now, which may lead to the out-of-bounds access. As a temporary band-aid fix, introduce a mutex for serializing the process of the SysEx message packets.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.124-1DEBIAN-CVE-2024-57893
Debian:13linux6.12.9-1DEBIAN-CVE-2024-57893
Debian:14linux6.12.9-1DEBIAN-CVE-2024-57893
Ubuntu:22.04:LTSlinuxno fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux6.8.0-60.63UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-awsno fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-aws6.8.0-1029.31UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1029.31~22.04.1UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-azureno fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-azure6.8.0-1029.34UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-azure-6.116.11.0-1012.12~24.04.1UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1029.34~22.04.1UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-azure-nvidia6.8.0-1016.17UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-gcp6.8.0-1030.32UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-gcp-6.116.11.0-1011.11~24.04.1UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1030.32~22.04.1UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-gke6.8.0-1025.29UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1012.14UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-hwe-6.116.11.0-21.21~24.04.1UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-60.63~22.04.1UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-ibm6.8.0-1026.26UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1026.26~22.04.1UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-intel-iotgno fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-kvmno fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-60.63.1UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-60.63.1~22.04.1UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1028.31UBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-nvidia-6.116.11.0-1007.7UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1028.31~22.04.1UBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1028.31.1UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-nvidia-tegrano fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1008.8UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-nvidia-tegra-igxno fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-oem-6.116.11.0-1017.17UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1028.28UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-oracle6.8.0-1026.27UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1026.27~22.04.1UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-raspino fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-raspi6.8.0-1028.32UBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-riscv6.8.0-60.63.1UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-62.65~22.04.1UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-57893
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1017.18UBUNTU-CVE-2024-57893
Ubuntu:22.04:LTSlinux-xilinx-zynqmpno fix listedUBUNTU-CVE-2024-57893

Affected products (as reported)

VendorProductVersions
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before cff1de87ed14fc0f2332213d2367100e7ad0753a1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before d2392b79d8af3714ea8878b71c66dc49d3110f441da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before 9d382112b36382aa65aad765f189ebde9926c1011da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before 0179488ca992d79908b8e26b9213f1554fc5bacc
Linux Linux 2.6.12

References